using pam_exec to send pushover.net notifications of all logins (ssh, scp)

pushovernet.sh

Credit to @feldpos for providing the original version of this file, designed for inclusion into a .bashrc etc file

$ ls -l /etc/pam.d/pushovernet.sh
-rwxr-xr-x  1 root  wheel  485 Mar 22 14:48 /etc/pam.d/pushovernet.sh
$ cat /etc/pam.d/pushovernet.sh 
#!/bin/sh
(if [ "${PAM_SM_FUNC}" == "pam_sm_open_session" ]; then
    P_KEY="YOUR USER KEY HERE"
    P_TOKEN="YOUR APP TOKEN HERE"
    P_MSG="${PAM_USER} logged in to $(hostname) from ${PAM_RHOST} via ${PAM_SERVICE}"
    P_DATE=`date +%s`
    P_TITLE="Logins"

    nohup /usr/local/bin/curl -q -s     \
      --form-string "token=$P_TOKEN"    \
      --form-string "user=$P_KEY"       \
      --form-string "message=$P_MSG"    \
      --form-string "timestamp=$P_DATE" \
      --form-string "title=$P_TITLE"    \
      https://api.pushover.net/1/messages.json > /dev/null 2>&1 &
fi)

sshd pamd

add this line to the bottom of /etc/pam.d/sshd

session          optional       pam_exec.so             /etc/pam.d/pushovernet.sh

the results

Login: dan logged in to empty.int.unixathome.org from 10.1.1.1 via sshd

you could dump the parameters into a tmpfile which you immediately delete or possibly pass them via stdin to prevent that. seems more effort than it's worth, though. an attacker can not do much but annoy you with messages.

Using ubuntu? Replace:
if [ "${PAM_SM_FUNC}" == "pam_sm_open_session" ]; then
With:
if [ "${PAM_TYPE}" == "open_session" ]; then