Slack alert ssh login: Difference between revisions

From SWKLS WIKI
Jump to navigation Jump to search
No edit summary
No edit summary
 
(One intermediate revision by the same user not shown)
Line 1: Line 1:
<big>SSH Login Alerts to Slack Channel
==SSH Login Alerts to Slack Channel==
</big>


Edit .bash_profile and add:
Edit .bash_profile and add:
Line 18: Line 17:
# The script is triggered by way of an entry in .bash_profile in Roots home folder (/root/.bash_profile)
# The script is triggered by way of an entry in .bash_profile in Roots home folder (/root/.bash_profile)
# This script will not fire for SFTP logins (WinSCP, etc.)
# This script will not fire for SFTP logins (WinSCP, etc.)
IP="$(echo $SSH_CONNECTION | cut -d " " -f 1)"
IP="$(echo $SSH_CONNECTION | cut -d " " -f 1)"
HOSTNAME=$(hostname)
HOSTNAME=$(hostname)
Line 26: Line 24:
USER="Linux Serverbot - SSH Login"
USER="Linux Serverbot - SSH Login"
TOKEN="xoxp-x1-x2-x3-x4"
TOKEN="xoxp-x1-x2-x3-x4"
TEXT="SSH login from '$IP' to '$HOSTNAME' on '$NOW'."
TEXT="SSH login from '$IP' to '$HOSTNAME' on '$NOW'."
/usr/bin/curl https://slack.com/api/chat.postMessage -X POST -d "channel=${CHANNEL}" -d "text=${TEXT}" -d "username=${USER}" -d "token=${TOKEN}" -d "icon_url=${ICON_URL}"
/usr/bin/curl https://slack.com/api/chat.postMessage -X POST -d "channel=${CHANNEL}" -d "text=${TEXT}" -d "username=${USER}" -d "token=${TOKEN}" -d "icon_url=${ICON_URL}"
</syntaxhighlight>
</syntaxhighlight>
[[Category:Linux]]

Latest revision as of 13:47, 26 March 2020

SSH Login Alerts to Slack Channel

Edit .bash_profile and add:

sh /home/<username>/scripts/login.sh

Use mkdir to create a scripts directory and create/edit login.sh:

mkdir /home/<username>/scriptsf
vi /home/<username>/scripts/login.sh

Add to login.sh :

#!/bin/bash
# This script sends a SLACK notification when the root user logs in via SSH
# The script is triggered by way of an entry in .bash_profile in Roots home folder (/root/.bash_profile)
# This script will not fire for SFTP logins (WinSCP, etc.)
IP="$(echo $SSH_CONNECTION | cut -d " " -f 1)"
HOSTNAME=$(hostname)
NOW=$(date +"%e %b %Y, %a %r")
ICON_URL="https://swkls.org/ssh.png"
CHANNEL="#ansible"
USER="Linux Serverbot - SSH Login"
TOKEN="xoxp-x1-x2-x3-x4"
TEXT="SSH login from '$IP' to '$HOSTNAME' on '$NOW'."
/usr/bin/curl https://slack.com/api/chat.postMessage -X POST -d "channel=${CHANNEL}" -d "text=${TEXT}" -d "username=${USER}" -d "token=${TOKEN}" -d "icon_url=${ICON_URL}"