[A2017U1]

/etc/sshrc executes before a successful ssh login, you can use that to be notified before an attacker has any access to log files

[zAy0LfpBZLC8mAC]

... so? How does that contradict what I wrote?