shihaam/dotfiles
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

ssh-access-notify

Browse Source
This commit is contained in:
Shihaam Abdul Rahman 2023-04-01 17:20:19 +05:00
parent a0470b5f06
commit 28dce4b836
Signed by: shihaam
GPG Key ID: 6DA2E87EBC227636
2 changed files with 25 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
config/i3/config
View File

@ -219,3 +219,6 @@ exec --no-startup-id activate-linux
# Start dunst (notification service)
exec --no-startup-id dunst
# start ssh access notification script
exec --no-startup-id /home/shihaam/.scripts/notify-ssh-access.sh

22
scripts/notify-ssh-access.sh Executable file
View File

@ -0,0 +1,22 @@
#!/bin/bash
doas tail -fn0 /var/log/audit/audit.log | while read -r line; do
key=$(echo "$line" | grep -oP '(?<=key=").*?(?=")')
exe=$(echo "$line" | grep -oP '(?<=exe=").*?(?=")')
pid=$(echo "$line" | awk -F'ppid=[0-9]+ pid=' '{print $2}' | awk -F' ' '{print $1}')
username=$(echo "$line" | grep -oP '(?<=EUID=").+?(?=")')
if [ "$key" = "ssh-key-read" ]
then
SUBJECT="SSH Key accessed!"
MESSAGE="exec=$exe\nuser=$username\npid=$pid"
if [ "$exe" = "/usr/bin/scp" ] || [ "$exe" = "/usr/bin/ssh" ]
then
notify-send "$SUBJECT" "$MESSAGE"
else
notify-send -u critical "$SUBJECT" "$MESSAGE"
fi
fi
done