Wiki.Cyli.Org

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.

==== ntfy-ssh-event ====
(Notify on SSH event)

This little script is called by the PAM daemon whenever there is a successful event in SSH, it ignores my own personal events, because I log in and out frequently, and don't want to hear my phone that much, just get rid of the first check if that's an issue.

<code bash ntfy-ssh-event.sh>
#!/usr/bin/bash
# /etc/pam-scripts/ntfy-ssh-event.sh
# This works with PAM, and appended to the bottom of /etc/pam.d/sshd;
# # This should send an alert whenever anyone logs in;
# session optional pam_exec.so /etc/pam-scripts/ntfy-ssh-event.sh

# No login alerts for me...
[ ${PAM_USER} == "steve" ] && exit

echo "SSH event: ${PAM_TYPE}, ${PAM_USER} from ${PAM_RHOST} on ${HOSTNAME} at $(date +'%Y-%m-%d+%H:%M:%S')" | mailx -s "SSH Alert" 5135551111@tmomail.net
</code>
What I get as a text message looks like;
<file>
 SSH Alert / SSH event: open_session, steve from 192.168.1.14 on Nuc at 2026-04-22+11:00:23
</file>
This requires a mail demon like postfix (configured as a satellite) and mailutils.