ntfy-server-alerts
Know the moment someone logs in to your servers. A push notification lands on your phone for every login, logout and failed attempt.
What it is
ntfy-server-alerts is a pair of installers that wire your servers up to ntfy, the simple HTTP pub-sub notification service. Use the hosted ntfy.sh or self-host your own, then point the installer at your endpoint, topic and access token.
There's no agent to run and nothing to compile: a Bash installer and systemd unit on Linux, and one PowerShell installer plus a scheduled task on Windows. Each install takes a minute and can run unattended.
What it covers
LINUX SSH
Login, logout and failed authentication (invalid user, bad password, rejected key), with user, source IP, hostname and time.
ANY DISTRO
Watches /var/log/auth.log on Debian and Ubuntu, or journalctl on RHEL, Fedora, Arch and Amazon Linux. Tested on Ubuntu.
HYPER-V HOSTS
Logon, logoff and failed logon on Server Core, from RDP, the console, WinRM and Windows Admin Center.
PRIORITIES
Failed logins arrive loudest and logouts quietest, so the alerts that matter stand out. Linux priorities are configurable.
Quick start: Linux
1. Copy the files to the server:
scp ntfy-linux/install-ntfy-ssh-alerts.sh \ ntfy-linux/ntfy-ssh-authlog.sh \ ntfy-linux/ntfy-ssh-authlog.service \ user@new-server:/tmp/
2. Run the installer. It prompts for the endpoint, topic and token, or takes them from the environment with -y:
ssh user@new-server '
sudo NTFY_ENDPOINT=https://ntfy.example.com \
NTFY_TOPIC=ssh-alerts \
NTFY_ACCESS_TOKEN=ntfy_xxxxxxxxxxxxxxxx \
bash /tmp/install-ntfy-ssh-alerts.sh -y
'
3. Open a new SSH session and the alert arrives. Add --pam to use the PAM hook instead of the log watcher, or --uninstall to remove it.
Quick start: Windows Hyper-V
Copy install-ntfy-logon-alerts.ps1 to the Hyper-V host (the parent partition, not a guest VM) and run it from an elevated PowerShell prompt:
Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process -Force .\install-ntfy-logon-alerts.ps1 ` -NtfyEndpoint https://ntfy.example.com ` -NtfyTopic hyperv-alerts ` -NtfyAccessToken tk_xxxxxxxx
It turns on logon auditing and registers a task that fires on Security events 4624, 4625, 4634 and 4647. Use -WhatIf to preview and -Uninstall to remove it. The Windows guide covers updating, manual setup and RDP-only alerts.
Safe by design
NEVER LOCKS YOU OUT
A slow or failed notification never blocks a login. The PAM hook exits silently on bad config, and curl gives up after 10 seconds.
NO ALERT FLOOD
Windows Admin Center fires a burst of logons per visit, so repeats of the same user, IP and logon type are throttled for 60 seconds.
FAILURES ALWAYS SEND
Failed logons are never throttled. A brute-force burst is exactly the signal you want to see.
NO STORED PASSWORDS
The Windows task runs as SYSTEM. On Linux the token lives in a root-owned config file with mode 600.