Posting successful SSH logins to Slack

Excellent. I've been thinking about having a SSHD keylogger post to slack (or some other log). It's crazy that sshd doesn't have this functionality built-in. It's so important to know what your admins are executing on your machines. Aside from the fact that they might have been compromised, it's just good to know what sort of general administration is being done.

Re: Posting successful SSH logins to Slack

#5

Post by sandm » Fri, Jan 22, 2016, 12:54 PM UTC

Kenp77 wrote: post #3

Elegant. Thank you! Is there a way to extend it to override DND?

That's a great idea. But I didn't find any docs that explain how to override DND. I opened a feature request instead, so we'll see how it goes :)

Re: Posting successful SSH logins to Slack

#6

Post by rogeryu » Fri, Jan 22, 2016, 1:14 PM UTC

tinco wrote: post #4

Excellent. I've been thinking about having a SSHD keylogger post to slack (or some other log). It's crazy that sshd doesn't have this functionality built-in. It's so important to know what your admins are executing on your machines. Aside from the fact that they might have been compromised, it's just good to know what sort of general administration is being done.

What about logwatch? That can do the same and a lot more. You can set it to mail you daily, which gives you an overview who logged in and how often. With a weekly mail you don't get these details, but it might be good enough.

Re: Posting successful SSH logins to Slack

#7

Post by jmiserez » Fri, Jan 22, 2016, 1:20 PM UTC

tinco wrote: post #4

Excellent. I've been thinking about having a SSHD keylogger post to slack (or some other log). It's crazy that sshd doesn't have this functionality built-in. It's so important to know what your admins are executing on your machines. Aside from the fact that they might have been compromised, it's just good to know what sort of general administration is being done.

If you don't want to install a "real" solution like Snoopy Logger that works for all users/shells/edge cases, you could always adapt the bash prompt to write the command out. E.g. I personally use something like this in my .bashrc which logs everything per user, but you could easily adapt this to post to Slack instead:

    # Adapted from https://unix.stackexchange.com/questions/207813/how-to-log-every-command-typed-into-bash-and-every-file-operation
    export ETERNAL_AUDIT_LOGFILE=~/.bash_eternal_auditlog
    PROMPT_COMMAND='RET_VAL=$?; history -a; echo "$(who am i | sed -e "s/[[:space:]]\+/ /g") [$$]: $(history 1 | sed "s/^[ ]*[0-9]\+[ ]*//" ) [$RET_VAL]" >> $ETERNAL_AUDIT_LOGFILE'

Output including return code and all parameters:

    ubuntu pts/0 2016-01-22 13:24 (example-loggedinuser-rdns.yourisp.com) [4379]: [2016-01-22 13:25:37] ps aux | grep python [0]

If you assume no malicious users this will work just fine.

Re: Posting successful SSH logins to Slack

#8

Post by pquerna » Fri, Jan 22, 2016, 1:29 PM UTC

tinco wrote: post #4

Excellent. I've been thinking about having a SSHD keylogger post to slack (or some other log). It's crazy that sshd doesn't have this functionality built-in. It's so important to know what your admins are executing on your machines. Aside from the fact that they might have been compromised, it's just good to know what sort of general administration is being done.

(disclaimer, I'm a co-founder of ScaleFT)

If you are interested in a commercial solution in this space, check out ScaleFT. Besides the dynamic SSH certificates, we also track both SSH keys used and access events, which you can then pull via an API across all your machines. We also have a Slack notifier, though It needs a little love & cleanup.

We're currently in what I could best call a beta: https://www.scaleft.com/

Re: Posting successful SSH logins to Slack

#9

Post by _yy » Fri, Jan 22, 2016, 1:43 PM UTC

Is Slack really the right place for security-critical notifications?

Re: Posting successful SSH logins to Slack

#10

Post by noja » Fri, Jan 22, 2016, 1:45 PM UTC

tinco wrote: post #4

Excellent. I've been thinking about having a SSHD keylogger post to slack (or some other log). It's crazy that sshd doesn't have this functionality built-in. It's so important to know what your admins are executing on your machines. Aside from the fact that they might have been compromised, it's just good to know what sort of general administration is being done.

> It's so important to know what your admins are executing on your machines...

Micromanagement at its finest!

> it's just good to know what sort of general administration is being done.

Your change management process will give you an overview of what your admins are doing.