The topic of this lab is notifications. The goal is to design a notification system that will send a notification by email every time a user logs in via SSH. This is a good way to notify us of malicious activity.
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- Install EPEL Repos, sendemail, python36, python36-devel
sudo yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpmsudo yum install python36 python36-develsudo yum install sendemail- Test Sending out an Email
sendemail -f [FROM_EMAIL] -u 'AUTH_NOTIFICATION' -t [TO_EMAIL] -s smtp.gmail.com:587 -o tls=yes -xu [USER_NAME] -xp [PASSWORD] -m "[YOUR MESSAGE]"- Write a Script to Send an Email with the Time Stamp and Username upon SSH Login
vim /home/cloud_user/onLogin.py#!/bin/python3.6 import subprocess from datetime import datetime import time import getpass msg = "#########################nTIME: " + datetime.now().strftime('%Y-%m-%d %H:%M:%S') + "nUSER: " + getpass.getuser() + "nWAS AUTHENTICATEDn#########################n" subprocess.check_output(['sendemail', '-f', '[FROM_EMAIL]', '-u', 'SCAN_NOTIFICATION', '-t', '[TO_EMAIL]', '-s', 'smtp.gmail.com:587', '-o', 'tls=yes', '-xu', '[USER_NAME]', '-xp', '[PASSWORD]', '-m', msg], stdin=None, stderr=None, shell=False, universal_newlines=False)ESC :wq ENTERchmod +x /home/cloud_user/onLogin.pysudo cp /home/cloud_user/onLogin.py /bin/- Configure SSH to Make Use of the Script
sudo vim /etc/pam.d/sshdsession optional pam_exec.so seteuid /bin/onSSHLoginHook.pyESC :wq ENTER
