Self-Hosted Linux Login Banner Management: update-motd vs motd-dynamic vs issue.net SSH Display Guide

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

ls -la /etc/update-motd.d/
# 00-header       - Distribution name and version
# 10-help-text    - Documentation links
# 50-landscape-sysinfo - System information (Landscape)
# 50-motd-news    - Ubuntu news
# 80-livepatch    - Livepatch status
# 90-updates-available - Package update count
# 91-release-upgrade - Release upgrade availability
# 95-hwe-eol      - HWE support status
# 97-overlayroot  - Overlayroot status
# 98-fsck-at-reboot - Filesystem check status
# 98-reboot-required - Reboot requirement notification

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

cat > /etc/update-motd.d/99-custom-info << 'EOF'
#!/bin/bash
echo ""
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "  Server: $(hostname -f)"
echo "  IP: $(hostname -I | awk '{print $1}')"
echo "  Uptime: $(uptime -p | sed 's/up //')"
echo "  Load: $(uptime | awk -F'load average:' '{print $2}')"
echo "  Memory: $(free -h | awk '/^Mem:/ {print $3 "/" $2}')"
echo "  Disk: $(df -h / | awk 'NR==2 {print $3 "/" $2 " (" $5 ")"}')"
echo "  Docker: $(docker ps -q 2>/dev/null | wc -l) containers running"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
EOF

chmod +x /etc/update-motd.d/99-custom-info

1
2
3
4
5

# Make a script non-executable to disable it
chmod -x /etc/update-motd.d/50-motd-news

# Or remove entirely
rm /etc/update-motd.d/50-motd-news

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

cat > /etc/update-motd.d/00-compliance-warning << 'EOF'
#!/bin/bash
echo "╔══════════════════════════════════════════════════════════════╗"
echo "║  WARNING: This system is for authorized use only.           ║"
echo "║  All activities are monitored and recorded.                 ║"
echo "║  Unauthorized access is prohibited and will be prosecuted.  ║"
echo "╚══════════════════════════════════════════════════════════════╝"
EOF

chmod +x /etc/update-motd.d/00-compliance-warning

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

# /etc/systemd/system/motd-update.service
cat > /etc/systemd/system/motd-update.service << 'EOF'
[Unit]
Description=Generate dynamic MOTD

[Service]
Type=oneshot
ExecStart=/usr/local/bin/generate-motd.sh
EOF

# /etc/systemd/system/motd-update.timer
cat > /etc/systemd/system/motd-update.timer << 'EOF'
[Unit]
Description=Update MOTD every 5 minutes

[Timer]
OnCalendar=*:0/5
Persistent=true

[Install]
WantedBy=timers.target
EOF

systemctl daemon-reload
systemctl enable --now motd-update.timer

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

#!/bin/bash
OUTPUT="/run/motd.dynamic"

{
  echo "╔══════════════════════════════════════════════════╗"
  echo "║  $(hostname -f) — $(date '+%Y-%m-%d %H:%M:%S')"
  echo "╚══════════════════════════════════════════════════╝"
  echo ""
  echo "System Status:"
  echo "  • CPU: $(top -bn1 | grep 'Cpu(s)' | awk '{print $2}' | cut -d'%' -f1)% used"
  echo "  • Memory: $(free | awk '/^Mem:/ {printf "%.1f", $3/$2*100}')% used"
  echo "  • Disk /: $(df -h / | awk 'NR==2 {print $5}') used"
  echo "  • Swap: $(free | awk '/^Swap:/ {if($2>0) printf "%.1f", $3/$2*100; else print "0"}')% used"
  echo ""
  
  # Security checks
  echo "Security Status:"
  if systemctl is-active --quiet fail2ban; then
    echo "  • fail2ban: ACTIVE ✓"
  else
    echo "  • fail2ban: INACTIVE ✗"
  fi
  if systemctl is-active --quiet ufw; then
    echo "  • Firewall: ACTIVE ✓"
  else
    echo "  • Firewall: INACTIVE ✗"
  fi
  
  # Pending updates
  UPDATES=$(apt list --upgradable 2>/dev/null | grep -c upgradable)
  if [ "$UPDATES" -gt 0 ]; then
    echo "  • Updates: $UPDATES packages pending"
  fi
  
  echo ""
  echo "Last 5 logins:"
  last -5 | awk '{print "  • " $1 " from " $3 " at " $4 " " $5 " " $6 " " $7}'
} > "$OUTPUT"

# Symlink for PAM
ln -sf "$OUTPUT" /etc/motd

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

version: "3.8"
services:
  motd-server:
    image: nginx:alpine
    container_name: motd-server
    volumes:
      - ./motd-templates:/usr/share/nginx/html:ro
    ports:
      - "8080:80"
    restart: unless-stopped

  motd-generator:
    image: alpine:latest
    container_name: motd-gen
    volumes:
      - ./motd-templates:/output
    entrypoint: |
      /bin/sh -c '
        while true; do
          echo "<pre>Server Farm Status — $$(date)" > /output/index.html
          echo "" >> /output/index.html
          echo "Active Servers: $$(grep -c "^" /etc/hosts 2>/dev/null || echo "N/A")" >> /output/index.html
          sleep 300
        done
      '
    restart: unless-stopped

1
2
3
4
5

# Enable banner display before authentication
Banner /etc/issue.net

# Restart SSH to apply
# systemctl restart sshd

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

**********************************************************************
*                                                                    *
*  WARNING: You are accessing a private computer system.            *
*  This system is for the use of authorized users only.             *
*  Individuals using this computer system without authority, or     *
*  in excess of their authority, are subject to having all of       *
*  their activities on this system monitored and recorded.          *
*                                                                    *
*  Anyone using this system expressly consents to such monitoring   *
*  and is advised that if such monitoring reveals possible          *
*  evidence of criminal activity, system personnel may provide      *
*  the evidence of such monitoring to law enforcement officials.    *
*                                                                    *
*  By logging in, you acknowledge that you have read and understand *
*  this notice.                                                      *
*                                                                    *
**********************************************************************

1
2
3
4
5
6
7

# Supported SSH escape sequences in Banner:
# %% = literal '%'
# %h = hostname (from reverse DNS)
# %d = date

# Example with hostname:
echo "Connecting to %h — Unauthorized access prohibited." > /etc/issue.net

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

cat > /usr/local/bin/update-issue.sh << 'SCRIPT'
#!/bin/bash
cat > /etc/issue.net << EOF
===================================================
  WARNING: Authorized access only to $(hostname -f)
  System location: $(curl -s ifconfig.me 2>/dev/null || echo "unknown")
  All connections are logged and monitored.
===================================================
EOF
SCRIPT

chmod +x /usr/local/bin/update-issue.sh

# Run at boot and periodically
echo "@reboot root /usr/local/bin/update-issue.sh" >> /etc/crontab