Blog Chia Sẻ

Gửi thông báo khi có người SSH hoặc gắt kết nối SSH vào 0

Tạo file /usr/local/bin/sshd-notify.sh và phân quyền +x để chạy được bash

Đây là trường hợp login bằng password


#!/bin/sh
WEBHOOK_URL="link_webhook"
if [ "$PAM_TYPE" != "close_session" ]; then
  host="`hostname`"
  message="SSH Login: $PAM_USER from $PAM_RHOST on $host"
  {
  echo "User: $PAM_USER"
  echo "Remote Host: $PAM_RHOST"
  echo "Service: $PAM_SERVICE"
  echo "TTY: $PAM_TTY"
  echo "Date: `date`"
  echo "Server: `uname -a`"
  } | curl -d "{\"body\" : \"SSH Connected\",\"connectColor\" : \"#FAC11B\",\"connectInfo\" : [{\"title\" : \"- Date: `date` \n- Service: $PAM_SERVICE \n- Server: `hostname -s` \n- From: $PAM_RHOST \n- Account: $PAM_USER\"},{}]}" -H "Content-Type: application/json" -X POST "$WEBHOOK_URL"

else
  host="`hostname`"
  message="SSH Closed: $PAM_USER from $PAM_RHOST on $host"
  {
  echo "User: $PAM_USER"
  echo "Remote Host: $PAM_RHOST"
  echo "Service: $PAM_SERVICE"
  echo "TTY: $PAM_TTY"
  echo "Date: `date`"
  echo "Server: `uname -a`"
  } | curl -d "{\"body\" : \"SSH Closed\",\"connectColor\" : \"#32a846\",\"connectInfo\" : [{\"title\" : \"- Date: `date` \n- Service: $PAM_SERVICE \n- Server: `hostname -s` \n- From: $PAM_RHOST \n- Account: $PAM_USER\"},{}]}" -H "Content-Type: application/json" -X POST "$WEBHOOK_URL"

fi

Đây là trường hợp login bằng access key
Với version OS khác nhau mà nó lưu log ở /var/log/auth hoặc /var/log/secure
và đổi
ssh_crtFp=`sed -ne “/${pidLogin}]: Found matching RSA key:/{s/^.* //g;p;q}” /var/log/secure`
or
ssh_crtFp=`sed -ne “/${pidLogin}]: Accepted publickey for .*ssh2/{s/^.* //g;p;q}” /var/log/auth.log`


#!/bin/bash
WEBHOOK_URL="link_webhook"
AUTHKEY="/home/{USER}/.ssh/authorized_keys" #path authorized_keys
userSSH="Empty"
authorized_keysSSH="Empty"
countKey=`expr $(wc -l <$AUTHKEY) + 1`

if [ "$PAM_TYPE" != "close_session" ]; then
	pidLogin=`echo $PPID` #check pid in file /var/log/auth
	ssh_crtFp=`sed -ne "/${pidLogin}]: Accepted publickey for .*ssh2/{s/^.* //g;p;q}" /var/log/auth.log`
	xx=""
	a=1
	while [ $a -lt $countKey ]
	do
		export ssh_line="$(sed -ne ${a}p <$AUTHKEY)"
		echo "$ssh_line" >~/.ssh/tempKey.pub
		sshGen=$(ssh-keygen -l -f ~/.ssh/tempKey.pub)
		ssh_lFp=()
		for i in $sshGen; do ssh_lFp+=($i) ; done

		xx=${ssh_lFp[1]}
		if [ "${ssh_lFp[1]}" == "$ssh_crtFp" ] ;then
			xx=${ssh_lFp[2]}
			userSSH=${ssh_lFp[2]}
			authorized_keysSSH=$ssh_line
			break
		fi

		# increment the value
		a=`expr $a + 1`
	done

	host="`hostname`"
	message="SSH Login: $PAM_USER from $PAM_RHOST on $host"
	{
		echo "User: $PAM_USER"
		echo "Remote Host: $PAM_RHOST"
		echo "Service: $PAM_SERVICE"
		echo "TTY: $PAM_TTY"
		echo "Date: `date`"
		echo "Server: `uname -a`"
	} | curl -d "{\"body\" : \"SSH Connected\",\"connectColor\" : \"#32a846\",\"connectInfo\" : [{\"title\" : \"- Date: `date` \n- Pid Login(/var/log/auth): $pidLogin  \n- AccsesKeyGen: $ssh_crtFp  \n- UserSSH: $userSSH \n- TTY: $PAM_TTY \n- Service: $PAM_SERVICE \n- Server: `hostname -s` \n- Remote Host: $PAM_RHOST \n- Account: $PAM_USER\"},{}]}" -H "Content-Type: application/json" -X POST "$WEBHOOK_URL"

else
	pidLogin=`echo $PPID` #check pid in file /var/log/auth
	ssh_crtFp=`sed -ne "/${pidLogin}]: Accepted publickey for .*ssh2/{s/^.* //g;p;q}" /var/log/auth.log`
	xx=""
	a=1
	while [ $a -lt $countKey ]
	do
		export ssh_line="$(sed -ne ${a}p <$AUTHKEY)"
		echo "$ssh_line" >~/.ssh/tempKey.pub
		sshGen=$(ssh-keygen -l -f ~/.ssh/tempKey.pub)
		ssh_lFp=()
		for i in $sshGen; do ssh_lFp+=($i) ; done

		xx=${ssh_lFp[1]}
		if [ "${ssh_lFp[1]}" == "$ssh_crtFp" ] ;then
			xx=${ssh_lFp[2]}
			userSSH=${ssh_lFp[2]}
			authorized_keysSSH=$ssh_line
			break
		fi

		# increment the value
		a=`expr $a + 1`
	done

	host="`hostname`"
	message="SSH Closed: $PAM_USER from $PAM_RHOST on $host"
	{
		echo "User: $PAM_USER"
		echo "Remote Host: $PAM_RHOST"
		echo "Service: $PAM_SERVICE"
		echo "TTY: $PAM_TTY"
		echo "Date: `date`"
		echo "Server: `uname -a`"
	} | curl -d "{\"body\" : \"SSH Closed\",\"connectColor\" : \"#FAC11B\",\"connectInfo\" : [{\"title\" : \"- Date: `date` \n- Pid Login(/var/log/auth): $pidLogin  \n- AccsesKeyGen: $ssh_crtFp  \n- UserSSH: $userSSH \n- TTY: $PAM_TTY  \n- Service: $PAM_SERVICE \n- Server: `hostname -s` \n- Remote Host: $PAM_RHOST \n- Account: $PAM_USER\"},{}]}" -H "Content-Type: application/json" -X POST "$WEBHOOK_URL"

fi


nano /etc/ssh/sshd_config

Tìm dùng LogLevel enable như dưới

LogLevel VERBOSE
UsePAM yes

Sửa file /etc/pam.d/sshd


nano /etc/pam.d/sshd

và thêm vào cuối file dòng sau

# SSH login notification
session optional pam_exec.so seteuid /usr/local/bin/sshd-notify.sh

Restart lại SSH


Ubuntu hoặc Debian Linux sử dụng
sudo systemctl restart ssh.service
## OR ##
service ssh restart

RHEL/CentOS Linux sử dụng

sudo systemctl restart sshd.service
## OR ##
service sshd restart