I think, going off the auth log is better, or just logs in general. Build one script that matches regex patterns and sends alerts and you can monitor for a lot more than just logins.
Send a message to teams channel on Linux server SSH connexion
11–20 of 21 posts
Re: Send a message to teams channel on Linux server SSH connexion
#12This is done via profile.d and can be circumvented by executing anything else than a login shell: ssh host /bin/sh -i Better would be enabling PAM via sshd_config and generating the message from there.
there is also sshd ForceCommand that could be used here
Re: Send a message to teams channel on Linux server SSH connexion
#13This is done via profile.d and can be circumvented by executing anything else than a login shell: ssh host /bin/sh -i Better would be enabling PAM via sshd_config and generating the message from there.
Or to actually get a login shell, but without loading the profile: > ssh host -t "bash --noprofile"
[deleted]
Re: Send a message to teams channel on Linux server SSH connexion
#14Original title: "Alert via Teams when user logon via SSH". Capitalization is important since it's actual Microsft Teams.
Re: Send a message to teams channel on Linux server SSH connexion
#15I think, going off the auth log is better, or just logs in general. Build one script that matches regex patterns and sends alerts and you can monitor for a lot more than just logins.
This is what I use for my home lab running NixOS:
https://github.com/heywoodlh/nixos-configs/blob/d5b0ffbcc4cb...
This script is so nice because it's so simple: it follows the journalctl output of sshd.service and then sends a push notification to me through Gotify's CLI when journalctl's output matches what I set $grep_regex_pattern to (I just need to remember to setup gotify when I setup my server). The best part is that it's so easy to modify this script for ANY systemd service that is using journalctl.
I alert on all successful and failed attempts, because in my home lab, I should be the only one logging in -- so I don't really get notifications unless I'm working on something. It's helped me a few times when I've accidentally left port 22 exposed to the world on some VPS' -- reminding me to add firewall rules to reduce access.
EDIT: clarified that sshd-montior sends alerts when matching regex pattern
Re: Send a message to teams channel on Linux server SSH connexion
#16If this means never having to open the Teams client ever again then I’m very excited.
I understood just as incorrectly as you :), but finally got what it does from others' comments. Clearly some editorial work could be used to disambiguate the title...
Re: Send a message to teams channel on Linux server SSH connexion
#17May want to add a proxy config to pass proxy information to the curl command. I would expect that some of the more important servers to get alerted about are those NOT able to access the internet directly.
Re: Send a message to teams channel on Linux server SSH connexion
#18May want to add a proxy config to pass proxy information to the curl command. I would expect that some of the more important servers to get alerted about are those NOT able to access the internet directly.
I'd personally base the alert on the syslog message as it comes in but YMMV
Re: Send a message to teams channel on Linux server SSH connexion
#19This, but for Matrix network! Man, the possibilities with an alerting system like this!
Forgive my lack of imagination, but what possibilities other than printing a message "User X has logged in on System Y"
Re: Send a message to teams channel on Linux server SSH connexion
#20tell me you are french, by not telling me you are french ;)
"connexion" :D