Skip to content

Instantly share code, notes, and snippets.

@Yaiba
Last active March 30, 2022 23:31
Show Gist options
  • Save Yaiba/df4ccd104469dbb04f9551c77dabf0a1 to your computer and use it in GitHub Desktop.
Save Yaiba/df4ccd104469dbb04f9551c77dabf0a1 to your computer and use it in GitHub Desktop.
get slack notify when login to ubuntu server
#/bin/sh
# #######################################
# pam REF: https://askubuntu.com/a/448602 https://blog.stalkr.net/2010/11/login-notifications-pamexec-scripting.html
# copy to /usr/local/bin, then +x
# add "session optional pam_exec.so type=open_session seteuid log=/tmp/pam.log /usr/local/bin/login_slack_notify.sh" to /etc/pam.d/sshd
# work on Ubuntu 14.04.5 / Centos 7.9
# selinux refer https://unix.stackexchange.com/a/474063 https://bugzilla.redhat.com/show_bug.cgi?id=737906#c1
#echo "User: $PAM_USER" >> /tmp/a.txt
#echo "Ruser: $PAM_RUSER" >> /tmp/a.txt
#echo "Rhost: $PAM_RHOST" >> /tmp/a.txt
#echo "Service: $PAM_SERVICE" >> /tmp/a.txt
#echo "TTY: $PAM_TTY" >> /tmp/a.txt
#echo "Date: `date`" >> /tmp/a.txt
#echo "Server: `uname -a`" >> /tmp/a.txt
#echo >> /tmp/a.txt
host=`hostname`
now=$(date '+%Y-%m-%d %H:%M:%S %Z')
ip=`hostname -I | cut -d " " -f 1`
slack_url="YOUR_SLACK_API"
content='{"text":"'"$PAM_USER"' from '"$PAM_RHOST"' on '"${host}-${ip}"' through '"${PAM_SERVICE}-${PAM_TTY}"' at '"$now"'"}'
curl -X POST -H 'Content-type: application/json' -d "$content" $slack_url
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment