How to Show Security Warning Message to SSH Unauthorized Users

SSH banner warnings are crucial when companies or organizations want to show a strict warning message to discourage unauthorized users from accessing a Linux server.

These SSH banner warning messages are displayed just before the SSH password prompt so that unauthorized users who are about to gain access are made aware of the aftermath of doing so. Typically, these warnings are legal consequences that unauthorized users can suffer should they decide to ahead with accessing the server.

Be cautious that a banner warning is by no means a way of blocking unauthorized users from logging in. The warning banner is simply a warning meant to warn unauthorized users from logging in. If you want to block unauthorized users from logging in, then additional SSH configurations are required.

The SSH banner contains some security warning information or general information. Following are some example SSH banner messages which I use on my Linux servers.

Example SSH Banner Message 1:

#################################################################
#                   _    _           _   _                      #
#                  / \  | | ___ _ __| |_| |                     #
#                 / _ \ | |/ _ \ '__| __| |                     #
#                / ___ \| |  __/ |  | |_|_|                     #
#               /_/   \_\_|\___|_|   \__(_)                     #
#                                                               #
#  You are entering into a secured area! Your IP, Login Time,   #
#   Username has been noted and has been sent to the server     #
#                       administrator!                          #
#   This service is restricted to authorized users only. All    #
#            activities on this system are logged.              #
#  Unauthorized access will be fully investigated and reported  #
#        to the appropriate law enforcement agencies.           #
#################################################################

Example SSH Banner Message 2:

ALERT! You are entering a secured area! Your IP, Login Time, and Username have been noted and have been sent to the server administrator!
This service is restricted to authorized users only. All activities on this system are logged.
Unauthorized access will be fully investigated and reported to the appropriate law enforcement agencies.

There are two ways to display messages one is using the issue.net file and the second one is using the MOTD file.

• /etc/issue.net – Display a warning banner message before the password login prompt.
• /etc/motd – Display a welcome banner message after the user has logged in.

So, I strongly recommended all system administrators display banner messages before allowing users to log in to systems. Just follow below simple steps to enable SSH logging messages.

Display SSH Warning Message to Users Before Login

To display SSH warning messages to all unauthorized users, you need to access the /etc/issue.net file to display banner messages using your preferred text editor.

$ sudo vi /etc/issue.net
Or
$ sudo nano /etc/issue.net

Add the following banner sample message and save the file. You can add any custom banner message to this file.

#################################################################
#                   _    _           _   _                      #
#                  / \  | | ___ _ __| |_| |                     #
#                 / _ \ | |/ _ \ '__| __| |                     #
#                / ___ \| |  __/ |  | |_|_|                     #
#               /_/   \_\_|\___|_|   \__(_)                     #
#                                                               #
#  You are entering into a secured area! Your IP, Login Time,   #
#   Username has been noted and has been sent to the server     #
#                       administrator!                          #
#   This service is restricted to authorized users only. All    #
#            activities on this system are logged.              #
#  Unauthorized access will be fully investigated and reported  #
#        to the appropriate law enforcement agencies.           #
#################################################################

Next, open the /etc/ssh/sshd_config configuration file.

$ sudo vi /etc/ssh/sshd_config
Or
$ sudo nano /etc/ssh/sshd_config

Search for the word “Banner” and uncomment out the line and save the file.

#Banner /some/path

It should be like this.

Banner /etc/issue.net (you can use any path you want)

Next, restart the SSH daemon to reflect new changes.

$ sudo systemctl restart sshd
Or
$ sudo service restart sshd

Now try to connect to the server you will see a banner message similar to below.

Display SSH Welcome Message to Users After Login

To display SSH welcome banner messages after login, we use /etc/motd file, which is used to display banner messages after login.

$ sudo vi /etc/motd
Or
$ sudo nano /etc/motd

Place the following welcome banner sample message and save the file.

###############################################################
#                        TECMINT.COM                          #
###############################################################
#                  Welcome to TecMint.com!                    #
#       All connections are monitored and recorded.           #
#  Disconnect IMMEDIATELY if you are not an authorized user!  #
###############################################################

Now again try to login into the server you will get both banner messages. See the screenshot attached below.

And that’s it. We hope you can now add your own custom SSH banner messages on your server to warn unauthorized users from accessing the system.