Where placing a script that starts when someone successfully connect to a server via cockpit web?

[posta246]

Hi everybody,
I'm not a systemd expert and I have not understood the architecture of cockpit very well... someone may help me to solve the titled problem? I would like to execute a script of mine that sends me a telegram message when that happens.
I think I could add the script using a parameter in the cockpit-ws systemd service config, but which one? By the way, I dont think this is the solution, cockpit-ws is always running, I need to capture the "cockpit login successfully" event.
Thanks to everyone could help me!!

[jelly]

Cockpit does not always run in the background, so what are you trying to achieve? Sending successful logins to telegram?

[posta246]

(Hi Jelly, thanks for interesting in my question)
Yes.
I have an easy script that does it for successful login via ssh. (credit: https://bogomolov.tech/Telegram-notification-on-SSH-login/). I would achieve the same with cockpit.
Is it possible? How?

[jelly]

As SSH and Cockpit use PAM for authentication maybe that is something to hook into. pam_exec.so seems to be a thing. Cockpit however does not really have post login hooks.

[posta246]

Hi, thanks for the tip... it works!!!
just added:
session optional pam_exec.so seteuid /usr/bin/telegram-send.sh "test-cockpit"
to the end of the file
/etc/pam.d/cockpit
and script telegram-send.sh sends me the "test-cockpit" message!

[posta246]

note: the solution does not work if you try to connect from the cockpit installed to one server to the one installed on another. I mean, once you are logged in server_A, if you try to login to another host server_B that has cockpit installed, you can successfully login but no message is sent. I think another /etc/pam.d module should be used.

[jelly]

If you connect to a different server from within Cockpit it opens a new ssh (so pam session) on that server.

[martinpitt]

First of all: Doing this via PAM seems fine, and the intended way of doing this. On a remote server that'll be just "ssh" of course, but you can just add the notification to ssh's PAM config there?

The only other control point that you have is cockpit.conf, and writing a custom authentication command which wraps cockpit-session (for local logins) or cockpit-ssh (for SSH logins) and does some extra bits there. However, this is a lot of work, and also not documented well. It's only an option if PAM really doesn't work for you, and you have lots of time to throw at this..

[posta246]

(thanks martinpitt too for the support)
Uhm, I'm missing something.
To frame my problem/need, please note my goal is to be notified when someone login to some VPSes of mine that have only ssh and cockpit exposed (this last use a private ip and is beyond authelia with 2fa authentication and a proxy, protected by fail2ban... so you can't easily access to it :)). I'm the only user, so I want to deploy a simple method to be informed of unexpected successful login.
I have done two things:

1. placed the session optional pam_exec.so seteuid /usr/bin/telegram-send.sh "test-cockpit" in the file /etc/pam.d/cockpit on each server, but it works - or, seems to - only on that one where I login first; after successfully login into Cockpit web, I can login into the other servers I have in the Host menù, but nothing happens;
2. create another script in /etc/profile.d/ that sends a message when someone login. It works if I login via ssh, but seems to do nothing when I connect from a different server from within Cockpit

If I understood what @martinpitt said is not the same of what I have described in point 2, maybe because my solution only works for interactive login, right? So I have to edit the /etc/pam.d/sshd file, adding the same content I put in the /etc/pam.d/cockpit?

Maybe at this point a better general approach should be to put the line session optional pam_exec.so seteuid /usr/bin/telegram-send.sh "Server_A_someone_is_logged" in a pam file (which one /etc/pam.d/login?) that if someone login in some way I cant imagine, I'm notified?