Sshrc

E-Mail Alert on SSH Login Event

• /etc/ssh/sshrc

=Telegram

1. !/bin/sh
2. Send a Telegram message on boot

TELEGRAM_CHAT_ID="xxx" TELEGRAM_BOT_TOKEN="xxx" ipaddr=`echo $SSH_CONNECTION | cut -d " " -f 1` Hostname=`hostname` NOW=$( date '+%F_%H%M%S' ) export LANG=C MESSAGE="$(echo "SSH Login From IP: $ipaddr To Host: $Hostname Date: $NOW ")" logger "Debug Reboot Message" logger $MESSAGE

/usr/bin/curl --connect-timeout 5 --max-time 10 --silent --output /dev/null \
   --data-urlencode "chat_id=${TELEGRAM_CHAT_ID}" \
   --data-urlencode "text=${MESSAGE}" \
   --data-urlencode "parse_mode=HTML" \
   --data-urlencode "disable_web_page_preview=true" \
   "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage"

Email

#!/bin/bash
#email on ssh login
ip=`echo $SSH_CONNECTION | cut -d " " -f 1`
Hostname=`hostname`
NOW=$( date '+%F_%H:%M:%S' )
Country=`curl -s https://ipapi.co/$ip/country/` > /dev/null

echo  "
UTC Date/Time: $NOW
IP Address: $ip
Country: $Country
Target Hostname: $Hostname
User: $USER
" | mail -s "SSH Login Alert From: $ip" user@domain.com