Setup Telegram Alert When an SSH Login is Successful

Introduction

Secure Shell (SSH) is a protocol used to securely access and manage remote servers. In critical server environments, it is important to receive notifications whenever an SSH login is successful. One effective way to receive these alerts is by using a Telegram Bot.

Telegram provides an API that allows us to automatically send messages to a chat or group when an SSH login occurs. In this article, we will set up a simple script that sends an alert to Telegram whenever an SSH login is successful.

Configuration

To enable Telegram alerts for successful SSH logins, we can add the following script to the sshrc file.

Steps

1. Open the terminal and edit the sshrc file:

    
   sudo nano /etc/ssh/sshrc

2. Add the following script:

    
   ip=`echo $SSH_CONNECTION | cut -d " " -f 1` 
   whoami=`whoami` 
   curl --request GET \ 
     --url "https://api.telegram.org/bot<YOUR_BOT_TOKEN>/sendMessage?chat_id=<YOUR_CHAT_ID>&text=SSH Login **$whoami** from IP $ip" \ 
     2>/dev/null > /tmp/ssh_login.log

   Replace <YOUR_BOT_TOKEN> with your Telegram bot token and <YOUR_CHAT_ID> with the chat or group ID that will receive the notifications.

3. Save the file and exit the editor.

4. Test by logging into the SSH server. If configured correctly, you will receive a Telegram message every time an SSH login is successful.

Conclusion

By adding this script to sshrc, we can easily receive notifications whenever an SSH login occurs on our server. This enhances security and helps monitor login activity effectively. Happy coding!