This is done via profile.d and can be circumvented by executing anything else than a login shell:<p><pre><code> ssh host /bin/sh -i
</code></pre>
Better would be enabling PAM via sshd_config and generating the message from there.
I've copied a project that basically sends a message to telegram with informations when someone connects on a linux server.<p>But this time it's for MS Teams channels, which is possible through Webhooks.<p>I thought that might be interesting for other persons so I share :) It can probably be adapted to any other webhooks, as soon as webhook urls accepts the JSON sent.
I think, going off the auth log is better, or just logs in general. Build one script that matches regex patterns and sends alerts and you can monitor for a lot more than just logins.
May want to add a proxy config to pass proxy information to the curl command. I would expect that some of the more important servers to get alerted about are those NOT able to access the internet directly.