SSH接続をSlackへ通知するスクリプト

slack-ssh-notice.bash

#!/bin/bash

# [how to use]
# 1. put this file as a /etc/ssh/sshrc
# 2. change file permission with "chmod 755 /etc/ssh/sshrc"

PATH=/usr/bin:/bin:/sbin:/usr/sbin
TIME=`LANG=C date "+%Y/%m/%d %X"`
USER=`whoami`
IP=`who | tac | head -n 1 | cut -d'(' -f2 | cut -d')' -f1`
SERVER=`hostname`

SLACK_WEBHOOK_URL='https://hooks.slack.com/services/ZZZZZ/YYYYY/XXXXX'
SLACK_CHANNEL='#alerts'
SLACK_USERNAME='ssh-notice'
SLACK_ICON_EMOJI=':fish:'
SLACK_MESSAGE_COLOR="good"  # good,danger,warning

SLACK_ATTACHMENTS=`cat << EOF
[
  {
    "color": "",
    "pretext": "",
    "fields": [
      {
        "title": "User",
        "value": "${USER}",
        "short": "false"
      },
      {
        "title": "Server",
        "value": "${SERVER}",
        "short": "false"
      },
      {
        "title": "Date",
        "value": "${TIME}",
        "short": "false"
      },
      {
        "title": "SourceAddress",
        "value": "${IP}",
        "short": "false"
      }
    ]
  }
]
EOF`

PAYLOAD=`cat << EOF
{
  "channel":     "${SLACK_CHANNEL}",
  "username":    "${SLACK_USERNAME}",
  "icon_emoji":  "${SLACK_ICON_EMOJI}",
  "attachments": ${SLACK_ATTACHMENTS}
}
EOF`

curl -X POST --data-urlencode "payload=${PAYLOAD}" ${SLACK_WEBHOOK_URL} &> /dev/null