ゴリ押し

ssh-alert.rb

require "net/https"
require "ipaddr"
require "json"
require "uri"

slack_url = URI.parse("") # slack webhook url

user = ENV["USER"]
remote_ip = IPAddr.new(ENV["SSH_CONNECTION"].split(" ")[0])
local_ip = IPAddr.new(ENV["SSH_CONNECTION"].split(" ")[2])
hostname = `echo #{local_ip} | xargs dig +short -x`.chomp.chop

body = {
  "username" => "SSH Login Alert",
  "icon_emoji" => ":shield:",
  "attachments" => [
    {
      "text" => "SSH connection has established",
      "color" => "good",
      "fields" => [
        {
          "title" => "From",
          "value" => remote_ip,
          "short" => true,
        },
        {
          "title" => "To",
          "value" => !hostname.empty? ? hostname : local_ip,
          "short" => true,
        },
        {
          "title" => "User",
          "value" => user,
          "short" => true,
        },
      ],
    },
  ],
}

Net::HTTP.post(slack_url, JSON.generate(body))