t3l3machus / gmail-ssh-log-alert

Receive email alerts on successful ssh logins based on a predefined IP whitelist OR a predefined IP country origin whitelist (using gmail)

Scope

Fail2ban is dope and SSH is quite secure, but what if someone still manages to authenticate to your machine e.g. by using saved/harvested credentials? Receive email alerts on successful ssh logins based on a predefined IP whitelist OR a predefined IP country origin whitelist.
Essentially: IF (ssh successful authentication ip address NOT IN ip whitelist) OR (ssh successful authentication ip address country of origin NOT IN country whitelist); then send email notification;

Note: Check ssh-log-alert using mailgun for a more secure and elegant version of this script.

Notification

Requirements

1. python3
2. sudo apt install geoip-bin
3. An existing or preferably a new and dedicated gmail account for sending the alerts. The account must be configured to accept Less secure app access (go to --> Manage your google account/Security/Less secure app access/turn on).

Configuration

Edit the script and:

1. replace your gmail authentication data and recipient email address.
2. edit variables country_whitelist OR ip_whitelist to suit your needs.

Usage

sudo chmod +x ssh-log-alert.sh

There are two ways to use this script:

1. Simply run the script (as root) which will result in a live log of every succesfull ssh authentication as well as an indication of email alert trigger success/failure, when a condition is met (you should test it that way also).
   ./ssh-log-alert.sh
2. Add script to the root crontab and have it run in the background when the machine starts:
   crontab -e
   then add line:
   @reboot /bin/bash /path/to/ssh-log-alert.sh
   reboot the machine and you are good to go (reboot now).