When you first log in to Google or Facebook, they send you a notification email to improve security. I think many IT people wonder, “How can I do the same thing for SSH?” If every SSH login sends a notification to the system manager, that helps security.

You have two options: write a command in your .bashrc or .zshrc, or use PAM (Pluggable Authentication Modules for Linux) to hook into the SSH login event. I recommend PAM.

This post is written for Ubuntu / Debian.

Instructions

Use any text editor (e.g., vim or nano) to open /etc/pam.d/sshd and move the cursor to the bottom. Type the following line into the file:
session optional pam_exec.so seteuid /root/notify.sh
This means that whenever you log in, log out, or do anything else with an SSH session, the SSH daemon will call "/root/notify.sh". You can replace the last parameter with any Linux command or file.

The second field, “optional”, means that if notify.sh returns a failure status code, the login still goes through. If you set it to “required”, you can’t log in when notify.sh fails, so I recommend not using “required”!

Now create /root/notify.sh, put the content below into the file, and make it executable:

#! /bin/bash


if [ $PAM_TYPE == 'open_session' ]; then
    subject = "[$(hostname)] User $PAM_USER login from $PAM_RHOST at $(date)"
elif [ $PAM_TYPE == 'close_session' ]; then
    subject = "[$(hostname)] User $PAM_USER logout from $PAM_RHOST at $(date)"
fi

echo subject > mail -s $subject root

When PAM runs notify.sh, it sets some environment variables, such as:

  • PAM_TYPE: Use this to detect whether the user is logging in or out
  • PAM_USER: The user who is logging in
  • PAM_RHOST: The remote user's IP address
  • PAM_SERVICE
  • PAM_TTY
You can use other notification methods, such as Slack or Telegram, by replacing the last line. Currently I use email for notifications.

I believe PAM runs synchronously, so if sending the notification takes a long time, your login will be slow.

This post refers to: