# ssh login messages
**URL:** https://forums.suse.com/t/ssh-login-messages/27792
**Category:** SLES Configure-Administer
**Created:** [January 11, 2016, 11:27pm UTC](https://forums.suse.com/t/ssh-login-messages/27792 "2016-01-11T23:27:13Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@mikenash](https://forums.suse.com/u/mikenash)
#### Post date: [January 11, 2016, 11:27pm UTC](https://forums.suse.com/t/ssh-login-messages/27792/1 "2016-01-11T23:27:13Z")
I want to remove or redirect the output from a ssh login session and produce my own output.
After changing the sshd\_config file I still have 2 lines that remain.
I could put in the “clear” command in the .profile and then produce my own output to obtain the results I require.
However, I would like to know if I could achieve these results through the sshd\_config file or another configuration file.
I expected no output with setting LogLevel to Quiet. I did not find any other parameter that may work.
Is there an explanation for why these two messages will always occur?
Is these a source file where this output can be changed?
Other suggestions? Thanks!
I configured sshd\_config parameters - LogLevel - PrintMotd - PrintLastLog
LogLevel QUIET
PrintMotd no
PrintLastLog no
[CODE]Original Output:
Using username “root”.
Authenticating with public key “rsa-key-20150918”
Last login: Mon Jan 11 16:02:58 2016 from [ibm758-r8pxkkk.pok.ibm.com](http://ibm758-r8pxkkk.pok.ibm.com)
Results:
Using username “root”.
Authenticating with public key “rsa-key-20150918”[/CODE]
---
### Author:  [@malcolmlewis](https://forums.suse.com/u/malcolmlewis)
#### Post date: [January 12, 2016, 12:31am UTC](https://forums.suse.com/t/ssh-login-messages/27792/2 "2016-01-12T00:31:48Z")
> [@](#):
>
> On Mon 11 Jan 2016 09:34:02 PM CST, mikenash wrote:
>
> I want to remove or redirect the output from a ssh login session and
> produce my own output.
> After changing the sshd\_config file I still have 2 lines that remain.
> I could put in the “clear” command in the .profile and then produce my
> own output to obtain the results I require.
> However, I would like to know if I could achieve these results through
> the sshd\_config file or another configuration file.
> I expected no output with setting LogLevel to Quiet. I did not find any
> other parameter that may work.
> Is there an explanation for why these two messages will always occur?
> Is these a source file where this output can be changed?
> Other suggestions? Thanks!
>
> I configured sshd\_config parameters - LogLevel - PrintMotd -
> PrintLastLog
> LogLevel QUIET
> PrintMotd no
> PrintLastLog no
>
> ## Code:
>
> Original Output:
> Using username “root”.
> Authenticating with public key “rsa-key-20150918”
> Last login: Mon Jan 11 16:02:58 2016 from [ibm758-r8pxkkk.pok.ibm.com](http://ibm758-r8pxkkk.pok.ibm.com)
>
> ## Results: Using username “root”. Authenticating with public key “rsa-key-20150918”
Hi
If you turn motd back on then just make it a blank file, it should (in
theory) work like you expect.
I use a custom /etc/motd here, that’s all I see and the PrintLastLog, I
turn that off and only see my motd.
–
Cheers Malcolm °¿° LFCS, SUSE Knowledge Partner (Linux Counter #276890)
SUSE Linux Enterprise Desktop 12 SP1|GNOME 3.10.2|3.12.51-60.20-default
If you find this post helpful and are logged into the web interface,
please show your appreciation and click on the star below… Thanks!
---
### Author:  [@mikenash](https://forums.suse.com/u/mikenash)
#### Post date: [January 12, 2016, 4:39pm UTC](https://forums.suse.com/t/ssh-login-messages/27792/3 "2016-01-12T16:39:08Z")
Greeting Malcolm, thank you for your reply. I have the expected results of no messages being issued when I manually login but when I use the authorized keys I receive these two messages. Maybe for security reasons but I do not see how this would improve security. This messages are more informative and should be suppressed by using the QUIET option. Logging messages to a file would be better option.
---
### Author:  [@malcolmlewis](https://forums.suse.com/u/malcolmlewis)
#### Post date: [January 12, 2016, 5:20pm UTC](https://forums.suse.com/t/ssh-login-messages/27792/4 "2016-01-12T17:20:33Z")
> [@mikenash;31120](#):
>
> Greeting Malcolm, thank you for your reply. I have the expected results of no messages being issued when I manually login but when I use the authorized keys I receive these two messages. Maybe for security reasons but I do not see how this would improve security. This messages are more informative and should be suppressed by using the QUIET option. Logging messages to a file would be better option.
Hi
I use keys as well and just don’t see that appear either via user or root… So to me it would appear something outside sshd is triggering those messages.
If you set sshd\_config back to the defaults, suppress PrintLastLog and have a bank motd file, do they still appear?
---
### Author:  [@mikenash](https://forums.suse.com/u/mikenash)
#### Post date: [January 12, 2016, 11:04pm UTC](https://forums.suse.com/t/ssh-login-messages/27792/5 "2016-01-12T23:04:36Z")
Greetings Malcolm, my /etc/motd is an empty file. I reset sshd\_defaults and the three lines do appear. I changed PrintLastLog to no and this line did not appear but the first two lines do appear. I deleted /etc/motd and the first two lines appear. I change LogLevel to QUIET and the first two lines appear. After each change I executed systemctl restart sshd. I am on Suse 12 SP1 on s390. Could this come from selinux? I am not sure how to check status or turn off. The sestatus command is not available and I do not have a /etc/selinux/config file.
---
### Author:  [@mikenash](https://forums.suse.com/u/mikenash)
#### Post date: [January 12, 2016, 11:56pm UTC](https://forums.suse.com/t/ssh-login-messages/27792/6 "2016-01-12T23:56:17Z")
I tried this configuration on Red Hat 7.2 s390 and I receive the same results. On this system I also verified that selinux was disabled. Any suggestions?
---
### Author:  [@malcolmlewis](https://forums.suse.com/u/malcolmlewis)
#### Post date: [January 13, 2016, 1:38am UTC](https://forums.suse.com/t/ssh-login-messages/27792/7 "2016-01-13T01:38:54Z")
> [@](#):
>
> On Tue 12 Jan 2016 10:04:02 PM CST, mikenash wrote:
>
> I tried this configuration on Red Hat 7.2 s390 and I receive the same
> results. On this system I also verified that selinux was disabled. Any
> suggestions?
Hi
I don’t have SLES 12 SP1 still haven’t upgraded. But do have SLED 12
SP1 and can’t duplicate, I think it’s outside ssh, but maybe adding
some verbosity to you ssh connection may help, eg;
```auto
ssh -vvv root@somehost
```
What form of authentication is being used, just local account for root,
or some other method. If not root user, is it the same?
–
Cheers Malcolm °¿° LFCS, SUSE Knowledge Partner (Linux Counter #276890)
SUSE Linux Enterprise Desktop 12 SP1|GNOME 3.10.2|3.12.51-60.20-default
If you find this post helpful and are logged into the web interface,
please show your appreciation and click on the star below… Thanks!
---
### Author:  [@mikenash](https://forums.suse.com/u/mikenash)
#### Post date: [January 13, 2016, 5:24pm UTC](https://forums.suse.com/t/ssh-login-messages/27792/8 "2016-01-13T17:24:25Z")
Greetings Malcolm, I do not receive these messages when I manually log on. This is the output when I change /etc/ssh/sshd\_config to use LogLevel DEBUG3 after I restart the service. [CODE]\>systemctl status sshd
sshd.service - OpenSSH Daemon
Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled)
Active: active (running) since Wed 2016-01-13 10:07:27 EST; 11min ago
Process: 2438 ExecStartPre=/usr/sbin/sshd-gen-keys-start (code=exited, status=0/SUCCESS)
Main PID: 2441 (sshd)
CGroup: /system.slice/sshd.service
└─2441 /usr/sbin/sshd -D
Jan 13 10:07:44 linux140 sshd[2448]: debug3: mm\_request\_send entering: type 120 [preauth]
Jan 13 10:07:44 linux140 sshd[2448]: debug3: mm\_request\_receive\_expect entering: type 121 [preauth]
Jan 13 10:07:44 linux140 sshd[2448]: debug3: mm\_request\_receive entering [preauth]
Jan 13 10:07:44 linux140 sshd[2448]: debug1: monitor\_read\_log: child log fd closed
Jan 13 10:07:44 linux140 sshd[2448]: debug3: mm\_share\_sync: Share sync
Jan 13 10:07:44 linux140 sshd[2448]: debug3: mm\_share\_sync: Share sync end
Jan 13 10:07:44 linux140 sshd[2448]: debug3: ssh\_sandbox\_parent\_finish: finished
Jan 13 10:07:44 linux140 sshd[2448]: debug1: PAM: establishing credentials
Jan 13 10:07:44 linux140 sshd[2448]: debug3: PAM: opening session
Jan 13 10:07:44 linux140 sshd[2448]: pam\_unix(sshd:session): session opened for user root by (uid=0)[/CODE]
I only receive the messages when I use the credentials. I receive the same results on other levels of Suse/RedHat Enterprise. I am guessing that this is a bug with the Enterprise distribution. Can you offer any suggestions to redirect this output?
---
### Author:  [@ab1](https://forums.suse.com/u/ab1)
#### Post date: [January 14, 2016, 3:30pm UTC](https://forums.suse.com/t/ssh-login-messages/27792/9 "2016-01-14T15:30:23Z")
On 01/12/2016 08:24 AM, malcolmlewis wrote:[color=blue]
> mikenash;31120 Wrote:[color=green]
>
> > Greeting Malcolm, thank you for your reply. I have the expected results
> > of no messages being issued when I manually login but when I use the
> > authorized keys I receive these two messages. Maybe for security
> > reasons but I do not see how this would improve security. This messages
> > are more informative and should be suppressed by using the QUIET option.
> > Logging messages to a file would be better option.[/color]
> > Hi
> > I use keys as well and just don’t see that appear either via user or
> > root… So to me it would appear something outside sshd is triggering
> > those messages.
>
> If you set sshd\_config back to the defaults, suppress PrintLastLog and
> have a bank motd file, do they still appear?[/color]
Like malcolmlewis, I use SSH keys for just about everything (maybe except
the first login as a user on a system) and I have never seen this message.
Considering that the choice of which key is used for authentication is
ONLY something on the client side, I think troubleshooting the SSH server
is the wrong approach. The SSH server has no idea about which keys are
available, and only knows that a key is sent from the client and can then
check that. As a result, my guess is that this is purely a client-side thing.
Which SSH client are you using? I’m using the one that comes with openssh
on Linux (openSUSE specifically). If you are using some other client,
tuning its logging may be what you want.
–
Good luck.
If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below…
---
### Author:  [@mikenash](https://forums.suse.com/u/mikenash)
#### Post date: [January 14, 2016, 4:23pm UTC](https://forums.suse.com/t/ssh-login-messages/27792/10 "2016-01-14T16:23:39Z")
Greetings ab, I am using the sshd that comes with Suse 12 SP1. From my workstation I am using putty, release 0.63. In putty configuration I unchecked display pre-authentication banner. This did not change the output. No other options seemed as likely candidates. What ssh clients for a windows 7 workstation are available?
---
### Author:  [@ab1](https://forums.suse.com/u/ab1)
#### Post date: [January 14, 2016, 4:44pm UTC](https://forums.suse.com/t/ssh-login-messages/27792/11 "2016-01-14T16:44:52Z")
Oh… windows, which I cannot test. Well, that changes things I guess but
since the Linux clients are not showing that line, it seems pretty likely
that this is clint-side related.
Try adding cygwin to your computer and then SSH from there.
Alternatively, try to SSH to the server from itself using its own SSH
client to see if you still see the message. Be sure to setup keys first,
of course, but this should be a pretty simple task:
```auto
ssh-keygen -t rsa
ssh-agent /bin/bash
ssh-add
ssh-copy-id localhost
#login once as yourself
ssh localhost
#see if you see any odd messages like you do on windows
```
–
Good luck.
If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below…
---
### Author:  [@malcolmlewis](https://forums.suse.com/u/malcolmlewis)
#### Post date: [January 14, 2016, 4:58pm UTC](https://forums.suse.com/t/ssh-login-messages/27792/12 "2016-01-14T16:58:12Z")
> [@](#):
>
> On Thu 14 Jan 2016 02:24:02 PM CST, mikenash wrote:
>
> Greetings ab, I am using the sshd that comes with Suse 12 SP1. From my
> workstation I am using putty, release 0.63. In putty configuration I
> unchecked display pre-authentication banner. This did not change the
> output. No other options seemed as likely candidates. What ssh clients
> for a windows 7 workstation are available?
Hi
Tried on WinX with PuTTY version 0.66, no additional messages seen, just
like logging in from SLED 12 or openSUSE Leap 42.1.
–
Cheers Malcolm °¿° LFCS, SUSE Knowledge Partner (Linux Counter #276890)
SUSE Linux Enterprise Desktop 12 SP1|GNOME 3.10.4|3.12.51-60.20-default
If you find this post helpful and are logged into the web interface,
please show your appreciation and click on the star below… Thanks!
---
### Author:  [@malcolmlewis](https://forums.suse.com/u/malcolmlewis)
#### Post date: [January 14, 2016, 5:22pm UTC](https://forums.suse.com/t/ssh-login-messages/27792/13 "2016-01-14T17:22:02Z")
> [@](#):
>
> On Thu 14 Jan 2016 02:58:12 PM CST, malcolmlewis wrote:
>
> > [@](#):
> >
> > On Thu 14 Jan 2016 02:24:02 PM CST, mikenash wrote:
> >
> > Greetings ab, I am using the sshd that comes with Suse 12 SP1. From my
> > workstation I am using putty, release 0.63. In putty configuration I
> > unchecked display pre-authentication banner. This did not change the
> > output. No other options seemed as likely candidates. What ssh clients
> > for a windows 7 workstation are available?
>
> Hi
> Tried on WinX with PuTTY version 0.66, no additional messages seen, just
> like logging in from SLED 12 or openSUSE Leap 42.1.
Hi
OK, I take it back, confirmed I see the same now… so it’s the PuTTY
client…
–
Cheers Malcolm °¿° LFCS, SUSE Knowledge Partner (Linux Counter #276890)
SUSE Linux Enterprise Desktop 12 SP1|GNOME 3.10.4|3.12.51-60.20-default
If you find this post helpful and are logged into the web interface,
please show your appreciation and click on the star below… Thanks!
---
### Author:  [@malcolmlewis](https://forums.suse.com/u/malcolmlewis)
#### Post date: [January 15, 2016, 11:24pm UTC](https://forums.suse.com/t/ssh-login-messages/27792/14 "2016-01-15T23:24:29Z")
> [@](#):
>
> On Thu 14 Jan 2016 03:22:02 PM CST, malcolmlewis wrote:
>
> > [@](#):
> >
> > On Thu 14 Jan 2016 02:58:12 PM CST, malcolmlewis wrote:
> >
> > > [@](#):
> > >
> > > On Thu 14 Jan 2016 02:24:02 PM CST, mikenash wrote:
> > >
> > > Greetings ab, I am using the sshd that comes with Suse 12 SP1. From my
> > > workstation I am using putty, release 0.63. In putty configuration I
> > > unchecked display pre-authentication banner. This did not change the
> > > output. No other options seemed as likely candidates. What ssh clients
> > > for a windows 7 workstation are available?
> >
> > Hi
> > Tried on WinX with PuTTY version 0.66, no additional messages seen, just
> > like logging in from SLED 12 or openSUSE Leap 42.1.
>
> Hi
> OK, I take it back, confirmed I see the same now… so it’s the PuTTY
> client…
Hi
Try the Bitvise SSH Client, you can import your keys, it is ok for
Individual use and works as expected.
I see in the putty code, it can set a (well doesn’t set, or give an
option with putty [plink shows username]) FLAG\_VERBOSE which doesn’t
seem to work as expected, as in still shows those items, if it did then
you would not see the info…
–
Cheers Malcolm °¿° LFCS, SUSE Knowledge Partner (Linux Counter #276890)
SUSE Linux Enterprise Desktop 12 SP1|GNOME 3.10.4|3.12.51-60.20-default
If you find this post helpful and are logged into the web interface,
please show your appreciation and click on the star below… Thanks!
---
### Author:  [@mikenash](https://forums.suse.com/u/mikenash)
#### Post date: [January 18, 2016, 3:35pm UTC](https://forums.suse.com/t/ssh-login-messages/27792/15 "2016-01-18T15:35:27Z")
Greetings, thanks everyone. Unfortunately I can only use what the company provides. Their download site has the older version of putty. When a newer version becomes available I will give it a try!