Amazon-ssm-agent: Display motd on session start

[awiddersheim]

This might be loosely related to #131, at least in my mind, but it'd be nice when starting a new session the systems motd gets displayed. This is usually handled by pam, at least that is the case on my Ubuntu system.

Also, something similar to SSH's Banner may be nice as well.

[kjpopov]

+1

[YujiaozhAws]

Thank you for the feedback, we'll investigate this.

[kchaitu4]

+1

[jusrob]

+1

[shannonrdunn]

@YujiaozhAws do you have this on the roadmap possibly? It is hard to achieve some NIST control requirements without the ability to display a message to users on login.

[jimilinuxguy]

@shannonrdunn if you do ssh over ssm the banner is displayed if that helps

[shannonrdunn]

@jimilinuxguy thanks! but we are trying not to allow ssh at all, and force ssm use. ssh over ssm you still have to use/manage the key pair right, and have port 22 exposed to the user?

[adamdmharvey]

This might help some of you:
https://github.com/elpy1/ssh-over-ssm

I can't vouch for that project, though it uses standard SSH, but does it OVER SSM, so far as I can tell does not require port 22 exposed, and it manages dynamic keypairs for short term use that the user themselves doesn't have to have, create, or even see.

Note I still thumb'd up the overall topic here which is getting a banner/MOTD through standard SSM Connect as ideal for my use cases, though was looking into other options.

[jimilinuxguy]

@shannonrdunn Unfortunately key management is still required. The agency I work with implemented ssh over ssm and closed port 22 and used a script similar to https://www.keepsecure.ca/blog/automating-access-through-a-jump-host-aws/ to automatically add the keys to the instance and expire them shortly to help fight the issue you are having.

[shannonrdunn]

@adamdmharvey @jimilinuxguy wow these are great, and work great. thanks so much.

[j-rat]

This would be fantastic to have especially for highly regulated industries.

[awiddersheim]

I forgot about this a bit. You can sort of achieve this now with the introduction of shell profiles.

https://aws.amazon.com/about-aws/whats-new/2020/10/now-customize-your-session-manager-shell-environment-with-configurable-shell-profiles/

[ferkhat-aws]

This can be accomplished by using shell profiles.
Closing.