SSH Telegram Notify

Have you ever wanted to get a Telegram notification when someone logs into your server via SSH? I did! I also wanted to automate the entire setup with Ansible for faster deployment and updates.

So, I created an Ansible role that does exactly that. It automatically configures your servers to send login/logout notifications to Telegram. It currently supports Debian/Ubuntu, but can easily be extended to other Linux distributions.

Why Use Telegram for SSH Notifications?

Monitoring SSH logins is an important security measure. It helps you:

• Detect unauthorized access attempts.
• Track who logs in and when.
• Get real-time alerts without relying on email.

Telegram is ideal for pet projects or small teams because it’s fast, lightweight, and has a simple API that’s easy to integrate into scripts. However, for enterprise environments, there are more robust options available, such as Slack, PagerDuty, or Opsgenie, which provide centralized management, audit logging, and enterprise-level access control.

Step 1: Create a Telegram Bot

To send messages to Telegram, you’ll need a bot. Don’t worry, no coding required.

1. Create a Telegram bot by messaging @BotFather
2. Send /newbot and follow the instructions
3. Save the bot token provided
4. Add the bot to your chat or group
5. Send any message to that chat, then find your chat ID by visiting: https://api.telegram.org/bot<YOUR_BOT_TOKEN>/getUpdates

That’s all you need, your bot is now ready to send messages.

Step 2: Automated Setup with Ansible

To make the process repeatable across multiple servers, I created an Ansible role , also published on Ansible Galaxy .

Installation

1. Install Ansible: Official Installation Guide

2. Install the role from Ansible Galaxy:

   ansible-galaxy install wiseelf.ssh_telegram_notify
   

Example Playbook

Create a playbook file, for example: playbook-ssh-telegram.yml

- hosts: servers
  become: true
  gather_facts: true
  roles:
    - ssh-telegram-notify

Then create inventory/group_vars/all with your bot credentials:

telegram_bot_token: "YOUR_BOT_TOKEN_HERE"
telegram_chat_id: "YOUR_CHAT_ID_HERE"

Add your servers to an inventory file, inventory/hosts:

[servers]
192.168.1.1
192.168.1.2
...
10.10.10.10

Finally, run the playbook:

ansible-playbook playbook-ssh-telegram.yml -i inventory

That’s it! Now you’ll receive a Telegram notification each time someone logs in (or out) via SSH.

Step 3: Manual Setup (If You Prefer Doing It by Hands)

If you don’t use Ansible, you can still install it manually. On your server:

1. Create a directory for your PAM scripts:

   sudo mkdir -p /etc/pam.scripts/
   sudo chmod 700 /etc/pam.scripts/
   

2. Create the script /etc/pam.scripts/login.sh:

   #!/usr/bin/env bash
   TOKEN="<YOUR_TELEGRAM_BOT_TOKEN>"
   ID="<YOUR_CHAT_ID>"
   HOSTNAME=$(hostname -f)
   DATE="$(date +"⏰ %H:%M:%S on %d %b %Y")"
   TIMEZONE="$(date +"%Z")"
   
   case "$PAM_TYPE" in
       "open_session")
           ACTION_EMOJI="🟢"
           ACTION_DESC="SSH Login"
           ;;
       "close_session")
           ACTION_EMOJI="🔴"
           ACTION_DESC="SSH Logout"
           ;;
       *)
           ACTION_EMOJI="🔵"
           ACTION_DESC="SSH $PAM_TYPE"
           ;;
   esac
   
   MESSAGE="$ACTION_EMOJI $ACTION_DESC: $PAM_USER@$HOSTNAME from $PAM_RHOST at $DATE ($TIMEZONE)"
   URL="https://api.telegram.org/bot$TOKEN/sendMessage"
   
   curl -s -X POST "$URL" \
       -d "chat_id=$ID" \
       -d "text=$MESSAGE" \
       -d "parse_mode=HTML" \
       -d "disable_notification=false" \
       > /dev/null 2>&1
   
   exit 0
   

3. Since it contains bot token this sript should be accessible only by root:

   chmod 700 /etc/pam.scripts/login.sh
   

4. Update PAM SSH configuration:

   session optional pam_exec.so /etc/pam.scripts/login.sh
   

Step 4: Testing

Once everything is in place:

• Use pamtester to verify PAM configuration syntax
• SSH into your server from another host.
• You should immediately receive a Telegram message with the login details.
• Log out and verify that you get a logout message too.

Conclusion

Using a few lines of Bash and an Ansible role, you can have a real-time Telegram alerting system for SSH logins. It’s simple, lightweight, and gives you instant visibility into who’s accessing your servers - whether it’s for auditing, security, or just peace of mind.

You can find the full Ansible role and source code here: https://github.com/wiseelf/ssh-telegram-notify