Simple SSH Login Notifier via PAM

alert-ssh-login.sh

# Create trigger file
touch /etc/ssh/sshd_notifier.sh
chmod +x /etc/ssh/sshd_notifier.sh
vim /etc/ssh/sshd_notifier.sh


#!/bin/bash
# /etc/ssh/sshd_notifier.sh
BOT_TOKEN="xxxxxx:12345678901234567890"
CHAT_ID="1234567890"

if [ ${PAM_TYPE} = "open_session" ]; then
  MESSAGE="${HOSTNAME}: ${PAM_USER}@${PAM_RHOST} - ${PAM_SERVICE}"
  curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" -d chat_id="${CHAT_ID}" -d text="${MESSAGE}" > /dev/null 2>&1
fi

# Test trigger
PAM_TYPE="open_session" /etc/ssh/sshd_notifier.sh

vim /etc/pam.d/sshd
# Add below:
# Notify SSH Login to Telegram
session optional pam_exec.so /etc/ssh/sshd_notifier.sh