SSH Login Alert
Know who signed in, instantly.
Get instant notifications when users log in or out via SSH. Track access with geolocation and server context.
Login/Logout Tracking
Monitor SSH sessions in real time.
Geolocation
Country flags and location lookup on public IPs.
PAM Integration
Automatic notifications via PAM hooks.
Detailed Info
Username, IP, hostname, and timestamp.
Quick installation
export SSH_LOGIN_API_KEY=your_api_key_here && curl -sSL https://s.fsend.me/ssh-login-alert-setup.sh | sudo -E bash
curl -O https://s.fsend.me/ssh-login-alert-setup.sh
export SSH_LOGIN_API_KEY=your_api_key_here
sudo -E bash ssh-login-alert-setup.sh
What gets installed
- /usr/local/bin/ssh-login-alert.sh - Handles SSH event notifications.
- /etc/pam.d/sshd - Modified to trigger notifications on login/logout.
- /etc/t69.conf - Stores SSH_LOGIN_API_KEY (separate from REBOOT_API_KEY).
Notification format
Each notification includes user, hostname, IP address with country flag, and timestamp.
π user@hostname [ 192.168.1.100 ]
π 2025-11-19 10:30:45 UTC
πΊπΈ 203.0.113.1 (US)
π user@hostname [ 192.168.1.100 ]
π 2025-11-19 10:30:45 UTC
π Local: 192.168.1.50
Note: Private IPs (10.x.x.x, 172.16-31.x.x, 192.168.x.x, 127.x.x.x) are detected and shown with a house icon, skipping geolocation API calls.
Management
sudo /usr/local/bin/ssh-login-alert.sh
sudo rm /usr/local/bin/ssh-login-alert.sh
sudo sed -i '/ssh-login-alert.sh/d' /etc/pam.d/sshd
SSH troubleshooting and updates
Notifications not working
- Verify PAM configuration: grep ssh-login-alert /etc/pam.d/sshd
- Check SSH_LOGIN_API_KEY in /etc/t69.conf
- Test manually: sudo /usr/local/bin/ssh-login-alert.sh
- Check SSH logs: journalctl -u sshd -f
Update API key
# Update SSH_LOGIN_API_KEY in config
sudo sed -i 's/^SSH_LOGIN_API_KEY=.*/SSH_LOGIN_API_KEY=your_new_key/' /etc/t69.conf
# Or add if it doesn't exist
echo "SSH_LOGIN_API_KEY=your_new_key" | sudo tee -a /etc/t69.conf
sudo chmod 600 /etc/t69.conf
Restore PAM configuration
# List available backups
ls -la /etc/pam.d/sshd.backup-*
# Restore from backup
sudo cp /etc/pam.d/sshd.backup-YYYYMMDD-HHMMSS /etc/pam.d/sshd
Reboot Alert
Track boots, reboots, and shutdowns.
Get instant notifications when your server starts, shuts down, or reboots. Lightweight systemd integration with secure key storage.
Boot Notifications
Get alerted when your server starts up.
Reboot Detection
Distinguish between shutdown and reboot events.
One-Line Setup
Install with a single command.
Secure Storage
API key stored with 600 permissions.
Quick installation
export REBOOT_API_KEY=your_api_key_here && curl -sSL https://s.fsend.me/reboot-alert.sh | sudo -E bash
curl -O https://s.fsend.me/reboot-alert.sh
export REBOOT_API_KEY=your_api_key_here
sudo -E bash reboot-alert.sh
What gets installed
- /etc/t69.conf - Securely stores your API key (600 permissions).
- /usr/local/bin/t69-notify.sh - Handles sending notifications.
- /etc/systemd/system/t69-notify.service - Auto-starts on boot and monitors events.
Testing and management
sudo /usr/local/bin/t69-notify.sh "Test notification"
systemctl status t69-notify.service
# Follow logs in real-time
journalctl -u t69-notify.service -f
# View recent logs
journalctl -u t69-notify.service -n 50
Uninstall
sudo systemctl stop t69-notify.service
sudo systemctl disable t69-notify.service
sudo rm /etc/systemd/system/t69-notify.service
sudo rm /usr/local/bin/t69-notify.sh
sudo rm /etc/t69.conf
sudo systemctl daemon-reload
π₯οΈ [Hostname] | π [IP Address] | π [Event] | β° [Timestamp]
π₯οΈ prod-server-01 | π 192.168.1.100 | π Powered on | β° 2025-11-19 10:30:45 UTC
Reboot troubleshooting
Service not active after installation
systemctl status t69-notify.service
Check for errors in the output. Common issues include network connectivity or incorrect API key.
Notifications not being received
- Verify API key is correct in /etc/t69.conf
- Check network connectivity to t69.me
- Review logs: journalctl -u t69-notify.service -n 50
- Test manually: sudo /usr/local/bin/t69-notify.sh "Test"
Script execution issues
# Verify script has execute permissions
ls -l /usr/local/bin/t69-notify.sh
# Should show: -rwxr-xr-x
Get Your API Key
Connect your Telegram account.
To use the monitoring tools, you need an API key from t69.me (MessageGateBot). This key lets your server send notifications to your Telegram account.
Private Chat
For personal notifications.
1. Chat with @MessageGateBot
2. Send /start
3. Send /key
Groups and Channels
For team notifications.
1. Add @MessageGateBot to group
2. Give admin permissions (channels)
3. Send /key in the group
Forum Topics
For organized alerts.
1. Enable Topics in group settings
2. Go to a specific topic
3. Send /key in that topic
View full documentation on t69.me
What is next?
Once you have your API key, you can install the monitoring tools above. Use the same key for both Reboot Alert and SSH Login Alert, or request different keys for each service.
Use Both Services
Install Reboot + SSH alerts together.
Both services can run on the same server. They share /etc/t69.conf but keep separate API keys.
Shared configuration file
# /etc/t69.conf
REBOOT_API_KEY=xxx-xxx-xxx-xxx
SSH_LOGIN_API_KEY=yyy-yyy-yyy-yyy
Install both services
# Install Reboot Alert
export REBOOT_API_KEY=your_reboot_key && curl -sSL https://s.fsend.me/reboot-alert.sh | sudo -E bash
# Install SSH Login Alert
export SSH_LOGIN_API_KEY=your_ssh_key && curl -sSL https://s.fsend.me/ssh-login-alert-setup.sh | sudo -E bash
Update individual keys
Re-run either installer to update just that service's API key:
# Update only REBOOT_API_KEY (preserves SSH_LOGIN_API_KEY)
export REBOOT_API_KEY=new_reboot_key && curl -sSL https://s.fsend.me/reboot-alert.sh | sudo -E bash
# Update only SSH_LOGIN_API_KEY (preserves REBOOT_API_KEY)
export SSH_LOGIN_API_KEY=new_ssh_key && curl -sSL https://s.fsend.me/ssh-login-alert-setup.sh | sudo -E bash