34 lines
1.1 KiB
Bash
Executable File
34 lines
1.1 KiB
Bash
Executable File
#!/bin/bash
|
|
#
|
|
# Yiğid BALABAN, <fyb@fybx.dev>
|
|
# login mailer
|
|
#
|
|
|
|
# set env var EMAIL and ENDPOINT
|
|
LOG_FILE="/var/log/auth.log"
|
|
LAST_LINE_FILE="/tmp/last_line_checked"
|
|
LOG_OUTPUT="/var/log/server-toolkit/login-mailer.log"
|
|
HOSTNAME=$(hostname)
|
|
|
|
if [[ ! -f "$LAST_LINE_FILE" ]]; then
|
|
echo "0" >"$LAST_LINE_FILE"
|
|
fi
|
|
|
|
LAST_LINE=$(cat "$LAST_LINE_FILE")
|
|
NEW_LINES=$(sed -n "$((LAST_LINE + 1)),\$p" "$LOG_FILE")
|
|
|
|
if echo "$NEW_LINES" | grep "sshd.*Accepted"; then
|
|
LOGIN_INFO=$(echo "$NEW_LINES" | grep "sshd.*Accepted" | awk '{print $9 " from " $11}')
|
|
|
|
RESPONSE_CODE=$(curl -s -o /dev/null -w "%{http_code}" -H "content-type: application/json" \
|
|
-d "$(jq -n --arg subject "New login on $HOSTNAME" --arg text "SSH login detected: $LOGIN_INFO" --arg recipient "$EMAIL" \
|
|
'{subject: $subject, text: $text, recipient: $recipient}')" \
|
|
"$ENDPOINT")
|
|
|
|
if [[ "$RESPONSE_CODE" -ne 200 ]]; then
|
|
echo "$(date '+%Y-%m-%d %H:%M:%S') - Failed to send login alert. Response code: $RESPONSE_CODE" >>"$LOG_OUTPUT"
|
|
fi
|
|
fi
|
|
|
|
wc -l "$LOG_FILE" | awk '{print $1}' >"$LAST_LINE_FILE"
|