Client disclaimer

README.md

@@ -30,6 +30,22 @@ The following environment variables are used to configure the server:
 Note that you need to add the *SYS_ADMIN* capability to the container.
 This is needed to create nested containers (namespaces) to secure sessions.
 
+CLI arguments
+-------------
+
+* `-b`: address to bind
+* `-d`: disclaimer to display to client
+* `-h`: tmate hostname
+* `-k`: ssh keys path
+* `-p`: port to bind
+* `-q`: port advertized
+* `-w`: websocket hostname
+* `-z`: websocket port
+* `-x`: use proxy protocol
+* `-v`: log level
+
+For more low-level information please see [tmate-main.c](./tmate-main.c).
+
 License
 --------
 

tmate-daemon-decoder.c

@@ -27,6 +27,7 @@ static void tmate_header(struct tmate_session *session,
 			 struct tmate_unpacker *uk)
 {
 	char *ssh_conn_str;
+	char *disclaimer;
 
 	session->client_protocol_version = unpack_int(uk);
 
@@ -56,6 +57,10 @@ static void tmate_header(struct tmate_session *session,
 
 	ssh_conn_str = get_ssh_conn_string(session->session_token_ro);
 	tmate_notify("Note: clear your terminal before sharing readonly access");
+	disclaimer = tmate_settings->disclaimer;
+	if (disclaimer != NULL) {
+		tmate_notify("%s", disclaimer);
+	}
 	tmate_notify("ssh session read only: %s", ssh_conn_str);
 	tmate_set_env("tmate_ssh_ro", ssh_conn_str);
 	free(ssh_conn_str);

tmate-main.c

@@ -102,11 +102,14 @@ int main(int argc, char **argv, char **envp)
 {
 	int opt;
 
-	while ((opt = getopt(argc, argv, "b:h:k:p:q:w:z:xv")) != -1) {
+	while ((opt = getopt(argc, argv, "b:d:h:k:p:q:w:z:xv")) != -1) {
 		switch (opt) {
 		case 'b':
 			tmate_settings->bind_addr = xstrdup(optarg);
 			break;
+		case 'd':
+			tmate_settings->disclaimer = xstrdup(optarg);
+			break;
 		case 'h':
 			tmate_settings->tmate_host = xstrdup(optarg);
 			break;

tmate.h

@@ -193,6 +193,7 @@ extern void tmate_ssh_server_main(struct tmate_session *session,
 
 struct tmate_settings {
 	const char *keys_dir;
+	const char *disclaimer;
 	const char *authorized_keys_path;
 	int ssh_port;
 	int ssh_port_advertized;