sh-login-alert.sh

#!/bin/bash

BOT_TOKEN="PUT_YOUR_BOT_TOKEN_HERE"
CHAT_ID="PUT_YOUR_CHAT_ID_HERE"

USER_LOGIN="$PAM_USER"
HOSTNAME="$(hostname -f 2>/dev/null || hostname)"
IP="$(echo "$PAM_RHOST")"
DATE="$(date '+%Y-%m-%d %H:%M:%S')"

MESSAGE="🔐 SSH Login Alert
Server: $HOSTNAME
User: $USER_LOGIN
IP: $IP
Time: $DATE"

curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
  -d chat_id="${CHAT_ID}" \
  --data-urlencode text="$MESSAGE" >/dev/null 2>&1

session optional pam_exec.so /usr/local/bin/ssh-login-alert.sh

sudo nano /etc/ssh/sshd_config

UsePAM yes

sudo systemctl restart ssh

sudo systemctl restart NetworkManager

sudo chmod +x /usr/local/bin/ssh-login-alert.sh

session optional pam_exec.so debug log=/var/log/ssh_notify_pam.log /usr/local/bin/ssh_notify.sh

session optional pam_exec.so seteuid debug log=/var/log/ssh_notify_pam.log /usr/local/bin/ssh-login-alert.sh

sudo chmod +x /usr/local/bin/ssh-login-alert.sh
sudo chown root:root /usr/local/bin/ssh-login-alert.sh

sudo PAM_USER=test PAM_RHOST=1.2.3.4 /usr/local/bin/ssh-login-alert.sh

#!/bin/bash

LOG="/var/log/ssh_notify_debug.log"

echo "============================" >> "$LOG"
echo "DATE: $(date)" >> "$LOG"
echo "USER: ${PAM_USER:-unknown}" >> "$LOG"
echo "RHOST: ${PAM_RHOST:-unknown}" >> "$LOG"
echo "SERVICE: ${PAM_SERVICE:-unknown}" >> "$LOG"

BOT_TOKEN="YOUR_BOT_TOKEN"
CHAT_ID="-100XXXXXXXXXX"

TEXT="SSH Login Alert
Server: $(hostname)
User: ${PAM_USER:-unknown}
IP: ${PAM_RHOST:-unknown}
Time: $(date '+%Y-%m-%d %H:%M:%S')"

/usr/bin/curl -v -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage"
--data-urlencode "chat_id=${CHAT_ID}"
--data-urlencode "text=${TEXT}" \

"$LOG" 2>&1

CURL_EXIT=$?
echo "CURL_EXIT=$CURL_EXIT" >> "$LOG"

exit 0

#!/usr/bin/env bash

Notify via Telegram on SSH login/logout, including the server’s hostname

Load Telegram configuration

source /root/.config/sshTelegram.env

Get the fully qualified hostname of this server

SERVER="$(hostname -f)"

Determine whether this is a login or logout event

case "$PAM_TYPE" in
open_session)
MSG="👤 SSH LOGIN on ${SERVER}: user=${PAM_USER} from=${PAM_RHOST} at=$(date +'%Y-%m-%d %H:%M:%S')"
;;
close_session)
MSG="👋 SSH LOGOUT on ${SERVER}: user=${PAM_USER} at=$(date +'%Y-%m-%d %H:%M:%S')"
;;
*)
# Do nothing for other PAM events
exit 0
;;
esac

Send the notification to the Telegram group

curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage"
-d "chat_id=${CHAT_ID_GROUP}"
-d "text=${MSG}"
-d "parse_mode=Markdown"
-d "disable_web_page_preview=true" >/dev/null