Pre-login banners

[ap0int3d]

Hi,
On my switches I have a pre-login banner. It is displayed at the very beginning of the ssh session before the user can login.
Currently WebSSH does not show these pre-login banners.
As they are usually used to display warning message stating it is forbidden to connect to the device unless authorized, i think it would be good to show those in a popup window with two buttons (Continue and Cancel) before actually signing into the device. If the user clicks Continue, then the connection is made. If the user clicks Cancel, then the connection attempt is aborted. You could even keep a log entry of the decision made by the user.

I am not sure it is a great idea for the user experience but it could be interesting from a security stand point.
What do you think of this idea ?

[bifrost0x]

Proposed in PR #151, with one SSH protocol caveat documented explicitly: SSH_MSG_USERAUTH_BANNER is delivered during authentication and Paramiko exposes it after authentication completes, so WebSSH cannot display it before credentials are used. The new flow pauses immediately afterward and before opening a jump-host forwarding channel, target shell, tmux probe, or startup command. A mandatory modal requires Continue or Cancel; decline, browser disconnect, or a 60-second timeout fails closed. The audit log records only the user, host/context, and decision—not remote-controlled banner text. Target and jump-host banners both use this flow.

[ap0int3d]

Nice. Works well with my switches ! Thank you !