41–50 of 71 posts
Earlier quoted context omitted.
Some shells do have this built in, for example bash's history file, typically set to ~/.bash_history
Which is easily defeated, of course ...
echo "`whoami` logged in at `date` from `echo $SSH_CLIENT`" | mail -s "`hostname` login" youremail@example.com
Note that people can still ssh execute remotely etc.
Is Slack really the right place for security-critical notifications?
Yes.
Earlier quoted context omitted.
Not in my book. Slack seems to be really cool but since it's not self-hosted and owned by a US entity, I'll stay clear.
It's an ssh login notification with a user and IP address. It's not notifying everyone what the new launch codes are. Let's not overstate it.
If you want to send email on login, add in /etc/profile : echo "`whoami` logged in at `date` from `echo $SSH_CLIENT`" | mail -s "`hostname` login" youremail@example.com Note that people can still ssh execute remotely etc.
Excellent. I've been thinking about having a SSHD keylogger post to slack (or some other log). It's crazy that sshd doesn't have this functionality built-in. It's so important to know what your admins are executing on your machines. Aside from the fact that they might have been compromised, it's just good to know what sort of general administration is being done.
Earlier quoted context omitted.
That's a great idea. But I didn't find any docs that explain how to override DND. I opened a feature request instead, so we'll see how it goes :)
That kind of gets you into this sort of problem: https://blogs.msdn.microsoft.com/oldnewthing/20110310-00/?p=... If you start overriding DND, now the user is going to want super-DND. Which somebody will then want to override, and so on. The correct solution is that your users need to not set DND when they in fact need to be disturbed, and your systems shouldn't be disturbing unnecessarily, and to the extent that's a…
This caused more than a few missed announcements and made escalation hard for a bit.
Earlier quoted context omitted.
Not in my book. Slack seems to be really cool but since it's not self-hosted and owned by a US entity, I'll stay clear.
What would you use instead?