Over the past weeks, I’ve failed to setup mail alerts on ssh login, sudo, and other events due to the various cloud providers blocking the SMTP ports for security reasons and making it difficult to setup a Mail Transfer Agent (MTA) quickly.

Slack alerts seemed to be the next logical step, and it takes considerably less time to setup. We’ll be leveraging Unix systems’ Pluggable Authentication Module (PAM) – which can be configured under /etc/pam.d – to setup slack alert on ssh login and logout events.

The following steps shall guide you to easily setup the same and maybe adapt the process to other services like discord, telegram, or what have you.

• Setup incoming webhook in slack
  • Follow the instructions under the Getting Started section on slack’s webhook documentation for creating an app and tieing it to a #channel under your desired workspace. This should land you with a Webhook URL.
• We’ll use the following script which sends a POST request with the details (IP ADDRESS, HOSTNAME) on either open_session (login) or close_session (logout) event as payload to the WEBHOOK URL.

#!/bin/bash

WEBHOOK_URL="<WEBHOOK_URL>"
CHANNEL="#<CHANNEL_NAME>"
HOST="$(hostname)"

if [ "$PAM_TYPE" == "open_session" ] || [ "$PAM_TYPE" == "close_session" ]; then
    content="\"attachments\": [{ 
        \"mrkdwn_in\": [\"text\", \"fallback\"], 
        \"fallback\": \"Event : $PAM_TYPE to \`$HOST\`\", 
        \"text\": \"SSH: $PAM_TYPE to \`$HOST\`\", 
        \"fields\": [ { 
                \"title\": \"User\", 
                \"value\": \"$PAM_USER\", 
                \"short\": true 
            }, { 
                \"title\": \"IP Address\", 
                \"value\": \"$PAM_RHOST\", 
                \"short\": true 
        } ],
        \"color\": \"#f30c00\" 
    }]"
    curl -X POST --data-urlencode \
        "payload={
                \"channel\": \"$CHANNEL\",
                \"mrkdwn\": true, 
                \"username\": \"SSH Notifications\", 
                $content, 
                \"icon_emoji\": \":warning:\"}" \
        "$WEBHOOK_URL" &
fi
exit

• You can name the script anything you want and place it anywhere; For this example, I’ve placed it in /usr/local/sbin/ssh-slack

• Make the script executable.

$ chmod +x /usr/local/sbin/ssh-slack

• One of the modules of PAM - pam_exec.so helps us trigger the scripts based on various authentication events. We’ll add the path to our script under /etc/pam.d/sshd which will trigger our script on any ssh authentication-related events.

$ sudo echo "session   optional   pam_exec.so   /usr/local/sbin/ssh-slack" >> /etc/pam.d/sshd

• That’s It! You should have the slack alerts working now.

Note

• The process described isn’t limited to ssh authentication-related events; We can configure it to work with other deamons like fail2ban and others to setup alerts or send logs to services on critical events.

My mentors for the project will be: @valeriocos @jgbarah @aswanipranjal

# What would I be working on?

• I will mainly be focusing on:
  • Adding support of source code related metrics to Grimoirelab with the help of analysis data produced by Graal.
  • Adapting Grimoirelab toolchain to be able to execute Graal and process the data produced by it.
  • Writing appropriate unit tests for additional backends, their corresponding supporting connectors, and methods.
  • Producing analytics related to proposed and calculated metrics*.
  • Adding documentation related to additional features and improvements in existing ones.

# What this is all about?

• This is me learning to manage a project, keeping track of the incremental process of development and documenting the work, which would later on (in the process) help to understand and explain things in a better way to newcomer or a community member.
• Also there will be some of the things that i’ll be learning throughout the process for the first time, will be following some guidelines, some of the best practices, which i’ll try and share.

# Community Bonding Period: Meeting

We had our 1st meeting for the community bonding period on Monday, 13th May 2019 at 14:00 CEST or 17:30 IST ; which was intended to answer the following questions:

• How do we keep a track of what’s being worked on?

  • One of my mentors (@aswanipranjal) for the project had shared an extensive list of guidelines (which i found really helpful) which included ideas such as maintaining a project-tracker repository which can work as a lab for experiment and a log for all the things that happens related to the project during the period. I liked the idea and I made one 😛 gsoc-graal

• How do we keep the community aware of the same?

  • We have planned to keep all the communication open so that everyone can sync and is free to participate and help us grow! If you have suggestions / comments about anything please do not hesitate to share them with us.

  • We will be discussing about the progress of this project every week at the #grimoirelab channel on Freenode IRC.

  • There will be a weekly report added to the project tracker, which i’ll make sure to also post on the mailing lists of CHAOSS.

Update:

• I successfully completed my Google Summer of Code project with CHAOSS on 22nd August 2019
• All the project related information can be found in the project tracker.