I am using Ntfy for my SSH alert and watchtower update. It is pretty cool to have this feature, so I can know who is accessing my server without my authorization. And know my docker needs to be updated as well.
SSH Alert Example
Command this to open code,
![](https://richardapplegate.io/wp-content/uploads/2024/06/image.png)
nano /etc/pam.d/sshd
Please add this code to the bottom of the page.
session optional pam_exec.so /usr/local/bin/ntfy-ssh-login.sh
![](https://richardapplegate.io/wp-content/uploads/2024/06/image-1-edited.png)
You should create a script file called /usr/local/bin/ntfy-ssh-login.sh
nano /usr/local/bin/ntfy-ssh-login.sh
![](https://richardapplegate.io/wp-content/uploads/2024/06/image-2.png)
Here code, make sure you change the server URL and username and password for nginx auth.
![](https://richardapplegate.io/wp-content/uploads/2024/06/image-3.png)
#!/bin/bash
# This is a PAM script hook that shows how to notify you when
# somebody logs into your server. Place at /usr/local/bin/ntfy-ssh-login.sh (with chmod +x!).
TOPIC_URL=yourntfydomain
NGINXUSER=yourusername
NGINXPASSWORD=yourpassword
if [ "${PAM_TYPE}" = "open_session" ]; then
curl -u ${NGINXUSER}:${NGINXPASSWORD} -H tags:warning -H prio:high -d "SSH login to $(hostname): ${PAM_USER} from ${PAM_RHOST}" "${TOPIC_URL}"
fi
Then Now you save Ctrl +x then yes
![](https://richardapplegate.io/wp-content/uploads/2024/06/image-4.png)
Make sure you have chmod permissions. Here is the command.
chmod +x /usr/local/bin/ntfy-ssh-login.sh
![](https://richardapplegate.io/wp-content/uploads/2024/06/image-5.png)
Go try logging into another terminal and see if it notifications you, then try logging in again and see if it notifications you. 🙂
![](https://richardapplegate.io/wp-content/uploads/2024/06/image-6.png)
It works well. It shows the username and IP address, so the IT team can protect the account if they don’t have permission to access our server.
Leave a Reply