Setup Ssh Login Notification With Ip Geolocation

By Author: Camimi Morales
Total Articles: 18
Comment this article

Server admins commonly use SSH to login to Linux servers. They will disable login via password due to the ease of brute force attacks these days. The recommended practice is to only allow login to the servers using private/public keys. It is also good to setup SSH notification with IP geolocation for better security. Admins will receive real-time notification whenever anyone logs in to the servers.

Getting an immediate notification when someone logs in is beneficial from a security viewpoint. It increases the chance that you can prevent an authorized party from doing real damage in your server. If you see a login for a suspicious region or ISP, you can take remedial action ASAP. A fast response to intrusion will give the bad actor no chance to steal your data.

Pre-requisites to setup SSH notification with IP geolocation
Our script will use the Web Service to query geolocation data using the user’s IP address. WS4 has data about Country, Region, City and ISP; more than enough for our notification example. That said, you can use a different package if you require more geolocation data.

To use the Web ...
... Service, you need an API key. If you don’t have one, kindly sign up one at https://www.ip2location.com/web-service/ip2location#123articleonline

In addition to the API key, you must also install
jq and wget in your Linux server. The wget package is required to call the Web Service while the jq package is required to parse JSON response from the web service.

SSH login notification script
To enable the SSH notification script to run upon login, the following code should be copied and pasted into your
~/.bashrc
file. Replace
IP2LOCATION_API_KEY
with the actual Web Service API key. If you want to enable Slack notification, then replace
SLACK_WEBHOOK_URL
with the actual URL. Otherwise, comment out the Slack specific lines of codes. Lastly, edit
NOTIFICATION_EMAIL
with the email address that will receive the notification.

API_KEY="IP2LOCATION_API_KEY"
SLACK_WEBHOOK="SLACK_WEBHOOK_URL"
EMAIL="NOTIFICATION_EMAIL"
IP="$(echo $SSH_CONNECTION | cut -d " " -f 1)"
if [ ! -z "$IP" ]; then
RESULT="$(wget -q -O /dev/stdout 'https://api.ip2location.com/v2/?key='"$API_KEY"'&ip='"$IP"'&package=WS4')"
CITY="$(echo $RESULT | jq -r .city_name)"
REGION="$(echo $RESULT | jq -r .region_name)"
COUNTRY="$(echo $RESULT | jq -r .country_name)"
LOCATION="$(echo $CITY, $REGION, $COUNTRY | sed 's/^[, ]\+//g')"
ISP="$(echo $RESULT | jq -r .isp)"
HOSTNAME=$(hostname -f)
NOW=$(date +"%e %b %Y, %a %r (UTC %Z)")
# Slack notification
wget -q -O /dev/null --no-check-certificate --header 'Content-Type: application/json' --post-data '{"username":"'"$HOSTNAME"'", "icon_url":"https://i.imgur.com/X2W00e2.png", "channel":"#general", "attachments":[{"title":"SSH Notification", "color":"#FDAE02", "mrkdwn_in": ["text"], "text": "*IP Address*: '"$IP"'\n*Location:* '"$LOCATION"'\n*ISP:* '"$ISP"'\n*Date:* '"$NOW"'"}]}' $SLACK_WEBHOOK
# Email notification
echo "SSH login from $LOCATION ($IP)." | mail -s "SSH Login Notification" "$EMAIL"
fi

Conclusion
IP geolocation is useful to detect where your users are logging in from. If you see any locations that are in unexpected regions, you should be alert and perform a security audit of your system. Data breach is a very serious issue these days so it pays to be extra vigilant with your monitoring.