sh-login-alert.sh

#!/bin/bash

BOT_TOKEN="PUT_YOUR_BOT_TOKEN_HERE"
CHAT_ID="PUT_YOUR_CHAT_ID_HERE"

USER_LOGIN="$PAM_USER"
HOSTNAME="$(hostname -f 2>/dev/null || hostname)"
IP="$(echo "$PAM_RHOST")"
DATE="$(date '+%Y-%m-%d %H:%M:%S')"

MESSAGE="🔐 SSH Login Alert
Server: $HOSTNAME
User: $USER_LOGIN
IP: $IP
Time: $DATE"

curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
  -d chat_id="${CHAT_ID}" \
  --data-urlencode text="$MESSAGE" >/dev/null 2>&1

#!/usr/bin/env bash

Notify via Telegram on SSH login/logout, including the server’s hostname

Load Telegram configuration

source /root/.config/sshTelegram.env

Get the fully qualified hostname of this server

SERVER="$(hostname -f)"

Determine whether this is a login or logout event

case "$PAM_TYPE" in
open_session)
MSG="👤 SSH LOGIN on ${SERVER}: user=${PAM_USER} from=${PAM_RHOST} at=$(date +'%Y-%m-%d %H:%M:%S')"
;;
close_session)
MSG="👋 SSH LOGOUT on ${SERVER}: user=${PAM_USER} at=$(date +'%Y-%m-%d %H:%M:%S')"
;;
*)
# Do nothing for other PAM events
exit 0
;;
esac

Send the notification to the Telegram group

curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage"
-d "chat_id=${CHAT_ID_GROUP}"
-d "text=${MSG}"
-d "parse_mode=Markdown"
-d "disable_web_page_preview=true" >/dev/null