Slack alert ssh login

SSH Login Alerts to Slack Channel

Edit .bash_profile and add:

sh /home/<username>/scripts/login.sh

Use mkdir to create a scripts directory and create/edit login.sh:

mkdir /home/<username>/scriptsf
vi /home/<username>/scripts/login.sh

Add to login.sh :

#!/bin/bash
# This script sends a SLACK notification when the root user logs in via SSH
# The script is triggered by way of an entry in .bash_profile in Roots home folder (/root/.bash_profile)
# This script will not fire for SFTP logins (WinSCP, etc.)

IP="$(echo $SSH_CONNECTION | cut -d " " -f 1)"
HOSTNAME=$(hostname)
NOW=$(date +"%e %b %Y, %a %r")
ICON_URL="https://swkls.org/ssh.png"
CHANNEL="#ansible"
USER="Linux Serverbot - SSH Login"
TOKEN="xoxp-x1-x2-x3-x4"


TEXT="SSH login from '$IP' to '$HOSTNAME' on '$NOW'."
/usr/bin/curl https://slack.com/api/chat.postMessage -X POST -d "channel=${CHANNEL}" -d "text=${TEXT}" -d "username=${USER}" -d "token=${TOKEN}" -d "icon_url=${ICON_URL}"