[SSH Login Notification to Slack] This script notifies about SSH logins in a Slack channel #ssh #slack #linux

notify_ssh_login_slack.sh

#!/bin/bash

# Add an incoming webhook in Slack first.
# Then save this script somewhere, e.g. /etc/ssh/scripts/notify_ssh_login_slack.sh and execute these commands once: 
# chmod +x /etc/ssh/scripts/notify_ssh_login_slack.sh
# sudo echo "session optional pam_exec.so seteuid /etc/ssh/scripts/notify_ssh_login_slack.sh" >> /etc/pam.d/sshd

if [ "$PAM_TYPE" != "close_session" ]; then

        URL="<slack-webhook-url>"

        # Benutzername abrufen
        USER=$(whoami)

        # IP-Adresse abrufen
        IP=$(hostname -I | awk '{print $1}')

        HOST=$(hostname)

        CONTENT="\"attachments\": [ { \"mrkdwn_in\": [\"text\", \"fallback\"], \"fallback\": \"SSH login: $PAM_USER connected to $HOST ($IP)\", \"text\": \"SSH login to $HOST ($IP)\", \"f>

        curl -X POST --data-urlencode "payload={\"mrkdwn\": true, \"username\": \"SSH Notifications\", $CONTENT, \"icon_emoji\": \":inbox-tray:\"}" "$URL" &
fi