Slack alert ssh login: Difference between revisions
Jump to navigation
Jump to search
No edit summary |
No edit summary |
||
| Line 18: | Line 18: | ||
# The script is triggered by way of an entry in .bash_profile in Roots home folder (/root/.bash_profile) | # The script is triggered by way of an entry in .bash_profile in Roots home folder (/root/.bash_profile) | ||
# This script will not fire for SFTP logins (WinSCP, etc.) | # This script will not fire for SFTP logins (WinSCP, etc.) | ||
IP="$(echo $SSH_CONNECTION | cut -d " " -f 1)" | IP="$(echo $SSH_CONNECTION | cut -d " " -f 1)" | ||
HOSTNAME=$(hostname) | HOSTNAME=$(hostname) | ||
| Line 26: | Line 25: | ||
USER="Linux Serverbot - SSH Login" | USER="Linux Serverbot - SSH Login" | ||
TOKEN="xoxp-x1-x2-x3-x4" | TOKEN="xoxp-x1-x2-x3-x4" | ||
TEXT="SSH login from '$IP' to '$HOSTNAME' on '$NOW'." | TEXT="SSH login from '$IP' to '$HOSTNAME' on '$NOW'." | ||
/usr/bin/curl https://slack.com/api/chat.postMessage -X POST -d "channel=${CHANNEL}" -d "text=${TEXT}" -d "username=${USER}" -d "token=${TOKEN}" -d "icon_url=${ICON_URL}" | /usr/bin/curl https://slack.com/api/chat.postMessage -X POST -d "channel=${CHANNEL}" -d "text=${TEXT}" -d "username=${USER}" -d "token=${TOKEN}" -d "icon_url=${ICON_URL}" | ||
</syntaxhighlight> | </syntaxhighlight> | ||
Revision as of 13:45, 26 March 2020
SSH Login Alerts to Slack Channel
Edit .bash_profile and add:
sh /home/<username>/scripts/login.sh
Use mkdir to create a scripts directory and create/edit login.sh:
mkdir /home/<username>/scriptsf
vi /home/<username>/scripts/login.sh
Add to login.sh :
#!/bin/bash
# This script sends a SLACK notification when the root user logs in via SSH
# The script is triggered by way of an entry in .bash_profile in Roots home folder (/root/.bash_profile)
# This script will not fire for SFTP logins (WinSCP, etc.)
IP="$(echo $SSH_CONNECTION | cut -d " " -f 1)"
HOSTNAME=$(hostname)
NOW=$(date +"%e %b %Y, %a %r")
ICON_URL="https://swkls.org/ssh.png"
CHANNEL="#ansible"
USER="Linux Serverbot - SSH Login"
TOKEN="xoxp-x1-x2-x3-x4"
TEXT="SSH login from '$IP' to '$HOSTNAME' on '$NOW'."
/usr/bin/curl https://slack.com/api/chat.postMessage -X POST -d "channel=${CHANNEL}" -d "text=${TEXT}" -d "username=${USER}" -d "token=${TOKEN}" -d "icon_url=${ICON_URL}"