Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Posting successful SSH logins to Slack

sandrinodimattia.net

Post reply on HN
Print view View original

11–20 of 71 posts

Re: Posting successful SSH logins to Slack

#11

Post by Klathmon »

_yy wrote: post #9

Is Slack really the right place for security-critical notifications?

yes?

I mean the next step is to have an automated phone call go out to people (which is what we do for critical alerts).

Short of that, slack is on my desktop, laptop, and phone. If i don't have one of those around me at the time, you aren't getting ahold of me for any reason.

So yeah i think it's perfectly valid for security-critical notifications. Plus this isn't as security critical as you'd think. I don't want klaxons going off every time someone sshs into a server... This can just be an additional layer of security.

Re: Posting successful SSH logins to Slack

#12

Post by Diederich »

noja wrote: post #10
tinco wrote: post #4

Excellent. I've been thinking about having a SSHD keylogger post to slack (or some other log). It's crazy that sshd doesn't have this functionality built-in. It's so important to know what your admins are executing on your machines. Aside from the fact that they might have been compromised, it's just good to know what sort of general administration is being done.

> It's so important to know what your admins are executing on your machines... Micromanagement at its finest! > it's just good to know what sort of general administration is being done. Your change management process will give you an overview of what your admins are doing.

Could be used for micromanagement. But its required in some environments by some common regulations.

Re: Posting successful SSH logins to Slack

#13

Post by [deleted] »

tinco wrote: post #4

Excellent. I've been thinking about having a SSHD keylogger post to slack (or some other log). It's crazy that sshd doesn't have this functionality built-in. It's so important to know what your admins are executing on your machines. Aside from the fact that they might have been compromised, it's just good to know what sort of general administration is being done.

[deleted]

Re: Posting successful SSH logins to Slack

#15

Post by jrcii »

tinco wrote: post #4

Excellent. I've been thinking about having a SSHD keylogger post to slack (or some other log). It's crazy that sshd doesn't have this functionality built-in. It's so important to know what your admins are executing on your machines. Aside from the fact that they might have been compromised, it's just good to know what sort of general administration is being done.

Some shells do have this built in, for example bash's history file, typically set to ~/.bash_history

Re: Posting successful SSH logins to Slack

#16

Post by tinco »

noja wrote: post #10
tinco wrote: post #4

Excellent. I've been thinking about having a SSHD keylogger post to slack (or some other log). It's crazy that sshd doesn't have this functionality built-in. It's so important to know what your admins are executing on your machines. Aside from the fact that they might have been compromised, it's just good to know what sort of general administration is being done.

> It's so important to know what your admins are executing on your machines... Micromanagement at its finest! > it's just good to know what sort of general administration is being done. Your change management process will give you an overview of what your admins are doing.

Eh, the sysadmins would be monitoring eachother. I'm not saying they should have a manager that keeps their commands in check.

And yes a change management process is very nice and all, and I suppose that at Amazon no line is entered into a root sshd shell without each character being vetted thrice, but at your regular shop you can bet that there's loads of admins that type "ps aux" three times before getting it right. Not that that's terrible, but if you want to look at system administration as an engineering problem you have to know what's going on.

Re: Posting successful SSH logins to Slack

#17

Post by tinco »

jmiserez wrote: post #7
tinco wrote: post #4

Excellent. I've been thinking about having a SSHD keylogger post to slack (or some other log). It's crazy that sshd doesn't have this functionality built-in. It's so important to know what your admins are executing on your machines. Aside from the fact that they might have been compromised, it's just good to know what sort of general administration is being done.

If you don't want to install a "real" solution like Snoopy Logger that works for all users/shells/edge cases, you could always adapt the bash prompt to write the command out. E.g. I personally use something like this in my .bashrc which logs everything per user, but you could easily adapt this to post to Slack instead: # Adapted from https://unix.stackexchange.com/questions/207813/how-to-log-every-command-typed-into-…

I've looked into both Snoopy and a bash script as you said. They both have merits, but I think for it to be really reliable there's no better way than to just log keyboard input. Assuming there are malicious users for me is a big part of the motivation.

Re: Posting successful SSH logins to Slack

#18

Post by pc86 »

Tepix wrote: post #14
_yy wrote: post #9

Is Slack really the right place for security-critical notifications?

Not in my book. Slack seems to be really cool but since it's not self-hosted and owned by a US entity, I'll stay clear.

It's an ssh login notification with a user and IP address. It's not notifying everyone what the new launch codes are. Let's not overstate it.

Re: Posting successful SSH logins to Slack

#19

Post by [deleted] »

tinco wrote: post #17
jmiserez wrote: post #7

Earlier quoted context omitted.

If you don't want to install a "real" solution like Snoopy Logger that works for all users/shells/edge cases, you could always adapt the bash prompt to write the command out. E.g. I personally use something like this in my .bashrc which logs everything per user, but you could easily adapt this to post to Slack instead: # Adapted from https://unix.stackexchange.com/questions/207813/how-to-log-every-command-typed-into-…

I've looked into both Snoopy and a bash script as you said. They both have merits, but I think for it to be really reliable there's no better way than to just log keyboard input. Assuming there are malicious users for me is a big part of the motivation.

[deleted]

Re: Posting successful SSH logins to Slack

#20

Post by SixSigma »

tinco wrote: post #4

Excellent. I've been thinking about having a SSHD keylogger post to slack (or some other log). It's crazy that sshd doesn't have this functionality built-in. It's so important to know what your admins are executing on your machines. Aside from the fact that they might have been compromised, it's just good to know what sort of general administration is being done.

man syslog
Post reply on HN