Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Save fortybelowzero/470c409a2e56a6f8537853b9aff4c9db to your computer and use it in GitHub Desktop.
Save fortybelowzero/470c409a2e56a6f8537853b9aff4c9db to your computer and use it in GitHub Desktop.
Record server logins into a google chat space

Record server logins into a google chat space

So you'd like to get notifications in a private google chat space (room) whenever someone logs into a server as a bit of an audit trail.

First, create your a space in google chat, go into [Apps and Integrations] for the space, and create a webhook. give it a name, and copy the resulting webhook url.

Now on the server in question, create a shell script (ideally somewhere not especially obvious) with the following contents (put in the correct space-id, key and token from the webhook you've copied)

#!/bin/sh

host=$(hostname);
peep=$(whoami);
ip4=$(/sbin/ip -o -4 addr list eth0 | awk '{print $4}' | cut -d/ -f1)
timestamp=$(date);
curl -H 'Content-Type: application/json' -X POST "https://chat.googleapis.com/v1/spaces/YOUR_SPACE_ID/messages?key=YOUR_KEY&token=YOUR_TOKEN&threadKey=login" --data "{\"text\": \"Login on ${host} by ${peep} from ${ip4} at ${timestamp}\"}"

give it execution permissions (chmod 755 filename).

now edit the file /etc/pam.d/sshd (as sudo), and add the following line:

session    optional     pam_exec.so seteuid /path/to/your/script

Now, every time someone logs in, it should create a post in your space showing the hostname, username, remote ip address and timestamp 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment