login_notify.sh

#!/bin/bash
# location: /usr/local/share/login_notify.sh
# /etc/pam.d/sshd
# add optional      pam_exec.so /usr/local/share/login_notify.sh
function post_to_slack () {
        # format message as a code block ```${msg}```
        SLACK_MESSAGE="\`\`\`$1\`\`\`"

new ssh-login channel
https://hooks.slack.com/services/<channel-url>
        SLACK_URL=https://hooks.slack.com/services/<webhook-url>

        case "$2" in
                INFO)
                        SLACK_ICON=':slack:'
                        ;;
                WARNING)
                        SLACK_ICON=':warning:'
                        ;;
                ERROR)
                        SLACK_ICON=':bangbang:'
                        ;;
                *)
                        SLACK_ICON=':slack:'
                        ;;
        esac

        curl -X POST --connect-timeout 5 --data "payload={\"text\": \"${SLACK_ICON} ${SLACK_MESSAGE}\", \"username\": \"login-bot\"}" ${SLACK_URL}
}

DATE="Date:        `date`"
SERVER="Server:      `uname -a`"
LOGINMESSAGE="`grep -o -E 'sshd\['$PPID'\]: Accepted publickey for.*' /var/log/auth.log`"
# on Fedora
# LOGINMESSAGE="`journalctl --since today -u sshd | grep -o -E 'sshd\['$PPID'\]: Accepted publickey for.*' | tail -n 1`"

if [ "$PAM_TYPE" = "open_session" ]
then
        post_to_slack "${LOGINMESSAGE}\n${DATE}\n${SERVER}\n${PAM_AUTHTOK}" "INFO"
fi
exit 0