Last active
January 30, 2020 13:50
-
-
Save Caffe1neAdd1ct/920a63cecb612962e4ce51f92e4e4709 to your computer and use it in GitHub Desktop.
Alerts on SSH Login
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
## Email Alert - make sure xmail is installed and replace email address below | |
echo 'ALERT - $HOSTNAME - Root Shell Access on:' `date` `who` | mail -s "Alert: Root Access at $HOSTNAME from `who | awk '{print $6}'`" [email protected] & disown > /dev/null 2>&1 | |
## Register a webhook on slack "Incoming WebHooks" in the services section and replace hook url below | |
curl -X POST --silent --output /dev/null \ | |
-H 'Content-type: application/json' \ | |
-H "Accept: application/json" \ | |
--data @<(cat <<EOF | |
{ | |
"text": "ALERT - $HOSTNAME - $USER Shell Access on:' `date` `who`", | |
} | |
EOF | |
) \ | |
https://hooks.slack.com/services/T000000/T0000000/MORECHARSHERE & disown > /dev/null 2>&1 | |
## Both processes are put to the background to prevent hangs on ssh login and bash profile setup. | |
## Could prevent logins if the server is underload |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment