Send Slack to SSH login alert

ssh_notify_to_slack.sh

#!/bin/sh

# original from http://sandrinodimattia.net/posting-successful-ssh-logins-to-slack/

if [ "$PAM_TYPE" != "close_session" ]; then
  whitelist="127.0.0.1 localhost" # change here 
  is_white=0

  # check authorized host
  for HOST in $whitelist
  do
    test "$PAM_RHOST" == "$HOST" && is_white=1;
  done

  # send alert
  if [ "$is_white" -ne 1 ]; then
    url="https://hooks.slack.com/services/XXX/YYY/ZZZ" # change here
    channel="#xxx-your-channel" # change here
    icon=":dark_sunglasses:" # change here

    host="`hostname`"
    content="\"attachments\": [ { \"mrkdwn_in\": [\"text\", \"fallback\"], \"fallback\": \"SSH login: $PAM_USER connected to \`$host\`\", \"text\": \"SSH login to \`$host\` \", \"fields\": [ { \"title\": \"User\", \"value\": \"$PAM_USER\", \"short\": true }, { \"title\": \"User IP\", \"value\": \"$PAM_RHOST\", \"short\": true } ], \"color\": \"#F35A00\" } ]"
    curl -X POST --data-urlencode \
      "payload={
        \"channel\": \"$channel\",
        \"mrkdwn\": true,
        \"username\": \"ssh-login\",
        $content,
        \"icon_emoji\": \"$icon\"
    }" $url &
  fi
fi