LKS ITNSA SSH Alerting

1. Aktifkan logging di sshd_config

sudo nano /etc/ssh/sshd_config

Cari, ubah dan aktifkan konfig dibawah ini

SyslogFacility AUTH

LogLevel VERBOSE

Restart service

sudo systemctl restart sshd

2. Bikin alerting script

Install kalau belum agar bisa menjalankan command mail di script nantinya

apt-get install mailutils

#!/bin/bash

while true; do

tail -n0 -F /var/log/auth.log | \

while read -r line; do

if [[ $line == *"Invalid user"* ]]; then

echo "Alert: Failed SSH Login Attempt on $(hostname)" | \

mail -s "SSH Failed Login Attempt Alert" ops@itnsa.id

done

Simpan script misal di /opt/ssh-alerting.sh

if [[ $line == *"Invalid user"* ]]; then

Text diatas bisa disesuikan dengan log nya di /var/log/auth.log

Buat menjadi executable

chmod +x /opt/ssh-alerting.sh

Jalankan script

./ssh-alerting.sh

Pastikan run di background

ps aux | grep ssh-alerting

3. Bikin scheduler

Agar saat reboot script bisa jalan otomatis

@reboot /opt/ssh-alerting.sh >/dev/null 2>&1

Okay itu mungkin ada cari lain seperti fail2ban dengan alerting ke email juga.

Thanks.

SA Bagus