Record SSH Login event

Recording ssh login event in the log with client’s IP.

SSH Login event

Update SSH config:

sudo vim  /etc/ssh/sshd_config
#Add folllwing line to config:
#Line: ForceCommand /usr/local/bin/ssh-login.sh
sudo service ssh restart

Create script:

sudo vim /usr/local/bin/ssh-login.sh

Script (/usr/local/bin/ssh-login.sh):

#!/bin/bash

if [[ -n $SSH_ORIGINAL_COMMAND ]] # command given, so run it
then
        exec /bin/bash -c "$SSH_ORIGINAL_COMMAND"
    else # no command, so interactive login shell
        IP_ADDRESS=$(echo $SSH_CLIENT | awk '{print $1}')

        # Send email notification
        TAG=`date +%Y-%m-%d-%H:%M:%S`

        echo "[$TAG] New SSH connection [$IP_ADDRESS]" >> /opt/sshconn.txt
        exec bash -il
fi

Records will be save to file: /opt/sshconn.txt