0

I have an ubuntu20 server and a bash script located in /etc/profile.d sends a message to telegram if anyone connect using ssh. The purpose of this script is to find out if there is a hack and to take actions.

I want to know the name of the computer that connected to ssh to include in a telegram message to see if the connecter is someone from my team or a hacker. I tried storing the whoami result in a variable but it shows the linux username, not the computer username of whoever connected. Can I execute the whoami command on the device of the connecter? Or any other way to meet what I'm thinking of. the bash code:

#!/usr/bin/env bash
# Import credentials form config file
. /home/roots/credentials.config
URL="https://api.telegram.org/bot${KEY}/sendMessage"
DATE="$(date "+%d %b %Y %H:%M")"
if [ -n "$SSH_CLIENT" ]; then
ip="$(echo $SSH_CONNECTION | cut -d " " -f 1)"
TEXT=" New login via ssh, username ${USER} IP (*${ip}*)
Date: ${DATE}"
curl -s -d "chat_id=${USERID}&text=${TEXT}&disable_web_page_preview=true&parse_mode=markdown" $URL > /dev/null
fi
1
  • Name from what perspective? if the host has a public IP and public DNS records you could pull those, but other than that hostnames are a local construct and is not observable from outside the network that the hostname is defined on. consider a NAT network. my PC has its local hostname, but no one outside my network could get it. they can lookup my public IP DNS, but all the stations in my LAN share that IP, so that name refers to all my PCs combined. I could also use multiple or different names on my systems if I use different naming protocols. Feb 7, 2023 at 18:53

1 Answer 1

0

Based on the post Determining the name of the host currently connected via SSH :

ssh sets the environment variable $SSH_CONNECTION to contain client IP address, client port number, server IP address, and server port number seperated by spaces.

You can use

echo ${SSH_CONNECTION%% *}

to get the client's IP address. To get the DNS name use something like host or dig -x:

host ${SSH_CONNECTION%% *}

Try then the command host ${SSH_CONNECTION%% *}.

Another answer noted that SSH_CONNECTION is lost when starting a sub-process such as by calling su.

Other answers in the post might also be useful.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .