From 523a00457a79b35ada98ac10172be557e3eea235 Mon Sep 17 00:00:00 2001 From: schererleander Date: Mon, 25 May 2026 01:53:38 +0200 Subject: feat(openssh): add PAM-based email alerts for logins --- modules/services/openssh.nix | 57 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) (limited to 'modules') diff --git a/modules/services/openssh.nix b/modules/services/openssh.nix index f86c13c..98241df 100644 --- a/modules/services/openssh.nix +++ b/modules/services/openssh.nix @@ -2,6 +2,7 @@ flake.modules.nixos.openssh = { lib, + pkgs, ... }: { @@ -33,5 +34,61 @@ }; }; }; + + security.pam.services.sshd.text = lib.mkDefault ( + lib.mkAfter '' + session optional pam_exec.so ${pkgs.writeShellScript "ssh-login-notify" '' + if [ "$PAM_TYPE" = "open_session" ]; then + TIMESTAMP=$(${pkgs.coreutils}/bin/date "+%Y-%m-%d %H:%M:%S %Z") + HOSTNAME=$(${pkgs.coreutils}/bin/cat /etc/hostname) + + ( + ${pkgs.coreutils}/bin/echo "To: leander@schererleander.de" + ${pkgs.coreutils}/bin/echo "From: root@sachiel.schererleander.de" + ${pkgs.coreutils}/bin/echo "Subject: SSH Login Alert: $PAM_USER" + ${pkgs.coreutils}/bin/echo "Content-Type: text/html; charset=UTF-8" + ${pkgs.coreutils}/bin/echo "" + ${pkgs.coreutils}/bin/cat < + + + + + + +

SSH Login Alert

+ +

A successful SSH login was just detected.

+ + + + + + + + +
User$PAM_USER
Host$HOSTNAME
Time$TIMESTAMP
IP Address$PAM_RHOST
Service$PAM_SERVICE
TTY$PAM_TTY
+ + +EOF + ) | /run/wrappers/bin/sendmail -f root@sachiel.schererleander.de leander@schererleander.de + fi + ''} + '' + ); }; } -- cgit v1.3.1