Use discord webhook to monitor ssh login

README.md

Post a webhook embed when someone is connecting via ssh to your server

To install

wget https://gist.githubusercontent.com/faceslog/e45fcaf85932f619fdaa8ae54b25cf38/raw/c4f3959bb7d1f30e49ef7b746c1f74bd07a97943/install.sh

chmod +x install.sh

bash install.sh [WEBHOOK URL]

To delete the webhook alert just type:

rm -R /etc/discord-ssh/

and then delete the line bash /etc/discord-ssh/login.sh in /etc/bash.bashrc

install.sh

#!/bin/bash

if [ $# -eq 0 ]; then
    echo "Please provide the webhook url as argument"
    exit 1
fi

sudo apt update
sudo apt install -y jq

mkdir '/etc/discord-ssh/'
cd '/etc/discord-ssh/'

echo "$1" > 'webhook.txt'

# discord sh
wget 'https://raw.githubusercontent.com/ChaoticWeg/discord.sh/master/discord.sh'
# login sh
wget 'https://gist.githubusercontent.com/faceslog/e45fcaf85932f619fdaa8ae54b25cf38/raw/6a4e7367bebc1c17fbf8857bf9f76e45f2a3fd23/login.sh'

echo 'bash /etc/discord-ssh/login.sh' >> '/etc/bash.bashrc'

login.sh

#!/bin/bash

WEBHOOK=$(cat '/etc/discord-ssh/webhook.txt')
FQDN=`hostname -f`

bash /etc/discord-ssh/discord.sh \
--webhook-url="$WEBHOOK" \
--username "SSH Alert" \
--title "SSH on $FQDN" \
--color "0xDC5844" \
--description '```A new ssh connection was detected !```' \
--field "User;$(whoami)" \
--field "Date;`date`" \
--timestamp

The URL in the install.sh script may expire make sure they are updated in case of errors when installing