Mattermost (or Slack) Message on SSH Login

October 5, 2023 #100DaysToOffload #Curl #Mattermost #Slack #SSH

You have a server that you access over SSH. You have hardened it following the necessary best practices.

Now you can do one small thing for a little additional peace of mind: Set up Linux Pluggable Authentication Modules (PAM) to send a message to Mattermost (or Slack) on every successful SSH login.

Here is how you can do it:

Add a script to /usr/local/bin/ to send the notification message. Name it sshnotify.sh. Make it executable.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
#!/bin/sh
MATTERMOST_HOST='...'
MATTERMOST_WEBHOOK_KEY='...'
MATTERMOST_CHANNEL='...'
REMOTE_IP=`echo $SSH_CONNECTION | awk '{print $1}'`
SERVER_HOSTNAME=`hostname`
curl -i -X POST \
    -H 'Content-Type: application/json' \
    -d '{"channel":"'${MATTERMOST_CHANNEL}'","text": "Someone just logged in to your server '${SERVER_HOSTNAME}' from '${REMOTE_IP}'"}' \
    https://${MATTERMOST_HOST}/hooks/${MATTERMOST_WEBHOOK_KEY}

chmod +x sshnotify.sh

If you want to do the same but use Slack, then change the curl command accordingly.

1
2
3
4
5
curl -i -X POST \
    -H 'Content-Type: application/json' \
    -H "Authorization: Bearer ${SLACK_TOKEN}"
    -d '{"channel":"'${SLACK_CHANNEL}'","blocks":[{"type":"section","text":{"type":"mrkdwn","text":"Someone just logged in to your server '${SERVER_HOSTNAME}' from '${REMOTE_IP}'"}}]}' \
    https://slack.com/api/chat.postMessage