[Announce] SSH notifier script - maemo.org

Active Topics

Camera phone competition March 2023 "Endless" (35)
to General by Maemish - 2 days, 10 hrs ago
TLS 1.2 for N9 is ready (28)
to MeeGo / Harmattan by smartblu9 - 2 days, 11 hrs ago
Maemo repository (3)
to Community by torsen - 3 days, 2 hrs ago
Error after installing Leste on sdcard (11)
to Maemo 7 / Leste by Maemish - 4 days ago
Introducing ubiboot N9 (multiboot OS loader) (1,393)
to Alternatives by smatkovi - 5 days, 6 hrs ago
more...

Page 1 of 2

Next >

Thread Tools

	laasonen	2011-06-11 , 15:24
	Posts: 565 \| Thanked: 618 times \| Joined on Jun 2010 @ Finland	#1

I made simple script which notifies about users trying to connect or disconnect to SSH-server. I thought that some others might be also interested what someones are trying to do with our phones.

Phone version
How?

apt-get install sysklogd sudser
Uncomment the line about /var/log/auth.log from /etc/syslog.conf
stop sysklogd; start sysklogd
Run the script

Problems:

Sysklogd doesn't give disconnecter's name so only ip is shown when user disconnects from the server

Script:

Code:

sudo tail -f /var/log/auth.log | while read line; do
	id=$((id+1));
	if [[ $id -gt 10 ]]; then
		if [[ `echo $line | awk '{print $5}' | awk -F [ '{print $1}'` == "sshd" ]]; then
			if [[ `echo $line | awk '{print $6}'` == Failed ]]; then
			dbus-send --type=method_call --dest=org.freedesktop.Notifications /org/freedesktop/Notifications org.freedesktop.Notifications.SystemNoteInfoprint string:"`echo $line | awk '{print $9}'` failed to log in to SSH from `echo $line | awk '{print $11}'`";
			else
				if [[ `echo $line | awk '{print $6}'` == Accepted ]]; then
					dbus-send --type=method_call --dest=org.freedesktop.Notifications /org/freedesktop/Notifications org.freedesktop.Notifications.SystemNoteInfoprint string:"`echo $line | awk '{print $9}'` succefully logged in to SSH from `echo $line | awk '{print $11}'`";
				else
					if [[ `echo $line | awk '{print $6}'` == Received ]] && [[ `echo $line | awk '{print $7}'` == disconnect ]]; then
						dbus-send --type=method_call --dest=org.freedesktop.Notifications /org/freedesktop/Notifications org.freedesktop.Notifications.SystemNoteInfoprint string:"`echo $line | awk '{print $9}' | awk -F : '{print $1}'` disconnected from SSH";
					fi
				fi
			fi
		fi
	fi
done

Screenshot:

Desktop version
Requirements:

syslog-ng
>=bash
libnotify

Script:

Code:

ip=""
sudo tail -f /var/log/auth.log | while read line; do
	id=$((id+1));
	if [[ $id -gt 10 ]]; then
		if [ -n "$ip" ]; then
			notify-send "SSH Notifier" "`echo $line | awk '{print $11}'` disconnected from SSH from $ip!";
			ip=""
		else
			if [[ `echo $line | awk '{print $5}'` == sshd* ]]; then
				if [[ `echo $line | awk '{print $6}'` == Failed ]]; then
					notify-send "SSH Notifier" "`echo $line | awk '{print $9}'` failed to log in to SSH from `echo $line | awk '{print $11}'`!";
				else
					if [[ `echo $line | awk '{print $6}'` == Accepted ]]; then
						notify-send "SSH Notifier" "`echo $line | awk '{print $9}'` succefully logged in to SSH from `echo $line | awk '{print $11}'`!";
					else
						if [[ `echo $line | awk '{print $6}'` == Received ]] && [[ `echo $line | awk '{print $7}'` == disconnect ]]; then
							ip=`echo $line | awk '{print $9}' | awk -F : '{print $1}'`
						fi
					fi
				fi
			fi
		fi
	fi
done

Screenshot:

__________________
Couple of my applications:
ConnLock - Advanced phone lock
Sanakirja.org - A Sanakirja.org dictionary client
Wlan Driver Selector Applet - Switch easily between stock and bleeding edge drivers

Last edited by laasonen; 2011-06-11 at 15:31.

Quote & Reply |

The Following 6 Users Say Thank You to laasonen For This Useful Post:
ejasmudar, figaro, gionni88, jellyroll, Mentalist Traceur, stlpaul

tonypower88	2011-06-11 , 15:45
Posts: 96 \| Thanked: 29 times \| Joined on Jun 2011	#2

so each time I have to execute this script in background and keep it running ?

I think this script is not good in case I want to spy on someone when I give him/her my phone then I login with ssh and execuste x11vnc server and watch them live on vnc lol

also I think a better idea is allow only some trusted dns names or ips for SSH clients like my own PCs and other devices

Quote & Reply |

	laasonen	2011-06-11 , 15:56
	Posts: 565 \| Thanked: 618 times \| Joined on Jun 2010 @ Finland	#3

Originally Posted by tonypower88

so each time I have to execute this script in background and keep it running ?

I decided to release this only as a script, but you can make it launch on startup pretty easily by adding it to /etc/event.d/ in this kind of format:

Code:

start on started hildon-desktop

respawn

script
//CODE
end script

Originally Posted by tonypower88

I think this script is not good in case I want to spy on someone when I give him/her my phone then I login with ssh and execuste x11vnc server and watch them live on vnc lol

also I think a better idea is allow only some trusted dns names or ips for SSH clients like my own PCs and other devices

I'm not interested in spying people, but feel free to modify the script yourself

Quote & Reply |

Jigzy	2011-06-11 , 16:15
Posts: 176 \| Thanked: 110 times \| Joined on Jul 2010	#4

what is it with these James Bond wannabe's wanting to spy on other people!

Quote & Reply |

tonypower88	2011-06-11 , 16:53
Posts: 96 \| Thanked: 29 times \| Joined on Jun 2011	#5

Originally Posted by Jigzy

what is it with these James Bond wannabe's wanting to spy on other people!

like letting someone to use msn on your phone , then go to other room with your computer login using ssh , execute x11vnc server in background = ) watch them on vnc

Quote & Reply |

	laasonen	2011-06-11 , 17:00
	Posts: 565 \| Thanked: 618 times \| Joined on Jun 2010 @ Finland	#6

Originally Posted by tonypower88

like letting someone to use msn on your phone , then go to other room with your computer login using ssh , execute x11vnc server in background = ) watch them on vnc

This is illegal at least in here in Finland. Why would you like to break their trust and privacy?

Quote & Reply |

Mentalist Traceur	2011-06-11 , 18:05
Posts: 2,225 \| Thanked: 3,822 times \| Joined on Jun 2010 @ Florida	#7

If you want to spy on people, that's your issue. Don't install it, then, and move on. However, if you'd like to know when others are spying on you, this is a very useful utility.

Doesn't sysklogd slowly fill up rootfs space with the logs, though?

Quote & Reply |

	hawaii	2011-06-11 , 18:48
	Posts: 1,030 \| Thanked: 792 times \| Joined on Jun 2009	#8

Firstly, why would somebody have your root password? Secondly, why would you allow remote root log in? Thirdly, why would you be running daemons on an unsecured network?