SSH_ALERT is a Python-based monitoring tool that sends real-time notifications for SSH login attempts (successful and failed) via Telegram. It monitors SSH authentication logs to provide instant alerts, enhancing server security by keeping you informed of access activities.
Ensure the following software is installed:
- Python 3: Install using:
sudo apt install python3
- pip: Install using:
sudo apt install python3-pip
- rsyslog: Used for logging SSH authentication attempts.
-
Install Rsyslog:
sudo apt install rsyslog
-
Verify Rsyslog:
rsyslogd -v
-
Enable Authentication Logging:
- Edit Rsyslog configuration:
sudo nano /etc/rsyslog.conf
- Ensure this line is uncommented:
auth,authpriv.* /var/log/auth.log
- Edit Rsyslog configuration:
-
Restart Rsyslog:
sudo systemctl restart rsyslog
-
Clone the Repository:
git clone https://github.com/rubikproxy/SSHALERT.git
-
Navigate to SSH_ALERT Directory:
cd /SSHALERT/ -
Try To Run this script:
bash main.sh
- Enter Your Telegram
bot_token - Enter Your Telegram
chat_id
- Service Management:
- Start the Service:
sudo service sshalert start
- Check Service Status:
sudo service sshlert status
- Restart the Restart:
sudo service sshlert restart
- Start the Service:
To confirm that sshalert is running, check the process:
ps aux | grep sshalertSSH_ALERT automatically monitors /var/log/auth.log for SSH login attempts and failed logins, sending real-time notifications to your configured Telegram chat.
All alerts are logged to /var/log/SSH-Alert/sshalert.log within the SSHALERT directory for easy tracking and analysis.
- Log Checking: If alerts aren't sent, check
tail -f /var/log/SSH-Alert/sshalert.logfor errors. - Permission Issues: Run the script with root permissions.
SSH_ALERT is a powerful, simple-to-use tool to monitor SSH access and keep your server secure. Regularly check logs and update bot credentials as needed to ensure continuous operation.