Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Posting successful SSH logins to Slack

sandrinodimattia.net

Post reply on HN
Print view View original

51–60 of 71 posts

Re: Posting successful SSH logins to Slack

#51

Post by 15155 »

xena wrote: post #30
ultramancool wrote: post #29

Earlier quoted context omitted.

People are _way_ too trusting of Slack and similar services. You could run your own IRC or Mattermost server accessible only in your LAN or over VPN and this would be fairly safe. Heck, even SSL-only with cranked up SSL options would be fairly safe. Instead, people ship all their data off to a 3rd party company, often letting that 3rd party have control over their servers and such. Their customer data, their payment…

People will always feel comfortable trading privacy for convenience!

And liberty for the feeling of safety.

Re: Posting successful SSH logins to Slack

#52

Post by taylorhughes »

lazyant wrote: post #44

If you want to send email on login, add in /etc/profile : echo "`whoami` logged in at `date` from `echo $SSH_CLIENT`" | mail -s "`hostname` login" youremail@example.com Note that people can still ssh execute remotely etc.

pam_exec seems to be a more robust solution to login notifications than /etc/profile http://blog.stalkr.net/2010/11/login-notifications-pamexec-s...

Re: Posting successful SSH logins to Slack

#53

Post by lazyant »

mscman wrote: post #47
lazyant wrote: post #44

If you want to send email on login, add in /etc/profile : echo "`whoami` logged in at `date` from `echo $SSH_CLIENT`" | mail -s "`hostname` login" youremail@example.com Note that people can still ssh execute remotely etc.

You'll definitely want to add a '&' at the end of that line so that you don't delay user logins if the network is down or mail barfs.

right, actually I do have a delay in a server with no mail where it fails :-)

Re: Posting successful SSH logins to Slack

#54

Post by e28eta »

noja wrote: post #10
tinco wrote: post #4

Excellent. I've been thinking about having a SSHD keylogger post to slack (or some other log). It's crazy that sshd doesn't have this functionality built-in. It's so important to know what your admins are executing on your machines. Aside from the fact that they might have been compromised, it's just good to know what sort of general administration is being done.

> It's so important to know what your admins are executing on your machines... Micromanagement at its finest! > it's just good to know what sort of general administration is being done. Your change management process will give you an overview of what your admins are doing.

There's a github talk about using Hubot to do sysadmin. One of the advantages of having everything happening in a public forum is teaching.

Re: Posting successful SSH logins to Slack

#55

Post by detaro »

jrcii wrote: post #41
jlgaddis wrote: post #34

Earlier quoted context omitted.

Which is easily defeated, of course ...

Some file systems support append-only permissions, although I've never used them. I wonder if that would work with bash's history file?

No, since you can just turn it off or prepend all your commands with a space to hide them.

Re: Posting successful SSH logins to Slack

#57

Post by rmdoss »

MrSec wrote: post #37
tinco wrote: post #4

Excellent. I've been thinking about having a SSHD keylogger post to slack (or some other log). It's crazy that sshd doesn't have this functionality built-in. It's so important to know what your admins are executing on your machines. Aside from the fact that they might have been compromised, it's just good to know what sort of general administration is being done.

Look into auditd for logging execve() syscall instead. OSSEC can (directly) report or act on any thing reported through logs.

And send it to Slack now as well:

https://blog.sucuri.net/2016/01/server-security-integrating-...

Re: Posting successful SSH logins to Slack

#58

Post by plasticxme »

Klathmon wrote: post #11
_yy wrote: post #9

Is Slack really the right place for security-critical notifications?

yes? I mean the next step is to have an automated phone call go out to people (which is what we do for critical alerts). Short of that, slack is on my desktop, laptop, and phone. If i don't have one of those around me at the time, you aren't getting ahold of me for any reason. So yeah i think it's perfectly valid for security-critical notifications. Plus this isn't as security critical as you'd think. I don't want kl…

Slack is terrible for auditing, though. What's wrong with email?

Re: Posting successful SSH logins to Slack

#59

Post by RubyPinch »

plasticxme wrote: post #58
Klathmon wrote: post #11

Earlier quoted context omitted.

yes? I mean the next step is to have an automated phone call go out to people (which is what we do for critical alerts). Short of that, slack is on my desktop, laptop, and phone. If i don't have one of those around me at the time, you aren't getting ahold of me for any reason. So yeah i think it's perfectly valid for security-critical notifications. Plus this isn't as security critical as you'd think. I don't want kl…

Slack is terrible for auditing, though. What's wrong with email?

people are more likely to be looking at chat windows as opposed to emails
Post reply on HN