DEV Community: Ardiansyah Sulistyo

Get a Telegram Notification Every Time Someone SSHes Into Your Server

Ardiansyah Sulistyo — Wed, 02 Sep 2026 07:23:32 +0000

A fresh VPS starts receiving SSH brute-force attempts within minutes of
going public. Most of us find out about a breach after the damage -
a spike in outbound traffic, a suspended hosting account, a client asking
why their site is serving spam.

What if you just... knew? The second someone authenticates?

Here's a complete, working setup that sends a Telegram message to your
phone every time a user successfully logs in over SSH - key or password,
interactive or automated. It's about 30 lines of Bash plus one line of PAM
config. No agent, no daemon, no third-party service beyond Telegram's free
Bot API.

How it works

SSH login events pass through PAM (Pluggable Authentication Modules)
on Linux. PAM has a module called pam_exec that can run an arbitrary
script at specific points in the auth lifecycle - including
open_session, which fires only after a successful login.

/etc/pam.d/sshd
  └─ pam_exec (open_session) ──▶ /usr/local/bin/ssh-notify
                                       └─ curl → Telegram Bot API

That's the entire architecture. No polling, no log-tailing, no extra
processes running in the background.

Step 1 - Create a Telegram bot (2 minutes)

Open Telegram, search for @botfather
Send /newbot, follow the prompts, name it whatever you like
Copy the token it gives you - looks like 123456789:ABCdefGHIjklMNOpqrSTUvwxYZ

Now get your chat ID:

Send any message to your new bot
Visit https://api.telegram.org/bot<YOUR_TOKEN>/getUpdates in a browser
Find "chat":{"id":YOUR_CHAT_ID} in the JSON response

That's it - no app registration, no OAuth flow, no approval process.

Step 2 - Store the credentials securely

sudo mkdir -p /etc/serversecure
sudo tee /etc/serversecure/telegram.conf > /dev/null <<'EOF'
BOT_TOKEN="123456789:ABCdefGHIjklMNOpqrSTUvwxYZ"
CHAT_ID="987654321"
EOF
sudo chmod 600 /etc/serversecure/telegram.conf
sudo chown root:root /etc/serversecure/telegram.conf

Mode 600, owned by root - the bot token is effectively a password.
Never commit this file to version control.

Step 3 - The notification script

Save this as /usr/local/bin/ssh-notify:

#!/usr/bin/env bash
# ssh-notify - Telegram SSH login alert via pam_exec
#
# CRITICAL: this script MUST exit 0 under all circumstances.
# A non-zero exit code from a pam_exec hook can block the login.

readonly CONF_FILE="/etc/serversecure/telegram.conf"
readonly STATE_DIR="/var/lib/ssh-notify"

main() {
    # Only fire on successful login, not on session close
    if [[ "${PAM_TYPE:-}" != "open_session" ]]; then
        return 0
    fi

    [[ -f "${CONF_FILE}" ]] || return 0
    # shellcheck source=/dev/null
    source "${CONF_FILE}"
    [[ -n "${BOT_TOKEN:-}" && -n "${CHAT_ID:-}" ]] || return 0

    # --- Rate limiting: collapse repeat alerts within 60s ---
    # Tools like VS Code Remote SSH or rsync open multiple sessions per
    # connection. Without this, one "login" becomes four notifications.
    local user="${PAM_USER:-unknown}"
    local rhost="${PAM_RHOST:-unknown}"
    local key
    key=$(echo "${user}@${rhost}" | tr -c '[:alnum:]@.' '_')
    local state_file="${STATE_DIR}/${key}"

    if [[ -f "${state_file}" ]]; then
        local last now elapsed
        last=$(cat "${state_file}" 2>/dev/null || echo 0)
        now=$(date +%s)
        elapsed=$(( now - last ))
        [[ "${elapsed}" -lt 60 ]] && return 0
    fi
    mkdir -p "${STATE_DIR}" 2>/dev/null
    date +%s > "${state_file}" 2>/dev/null

    # --- Build the alert ---
    local host ip
    host=$(hostname)
    ip=$(curl -sf --max-time 3 https://ifconfig.me 2>/dev/null || echo "unknown")

    local message="🔐 *SSH Login Alert - ${host}*

🖥️ Server: \`${host}\` (\`${ip}\`)
👤 User: \`${user}\`
🌐 Source IP: \`${rhost}\`
🕒 Time: $(date -u '+%Y-%m-%d %H:%M:%S UTC')"

    # --- Send it async, hard-timeout, never block the login ---
    (
        setsid curl -sf --max-time 5 \
            -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
            -d "chat_id=${CHAT_ID}" \
            -d "parse_mode=Markdown" \
            --data-urlencode "text=${message}" \
            >/dev/null 2>&1
    ) &

    return 0
}

main
exit 0

sudo chmod 755 /usr/local/bin/ssh-notify
sudo chown root:root /usr/local/bin/ssh-notify

Three design decisions worth calling out, because they're the difference
between "cool script" and "thing you can trust in production":

It always exits 0. A pam_exec hook that returns non-zero can be configured to block the login it's supposed to be reporting on. This script fails silently, always, no exceptions.
The curl call runs in a detached subshell (setsid ... &). If Telegram's API is slow or your network hiccups, your SSH login is never delayed waiting on it.
Rate limiting by IP+user. Without this, tools that open multiple SSH channels per "connection" (VS Code Remote is the worst offender) will spam you with 3-4 notifications for what is, to you, one login.

Step 4 - Wire it into PAM

echo "session    optional     pam_exec.so   seteuid /usr/local/bin/ssh-notify" | \
    sudo tee -a /etc/pam.d/sshd

The optional control flag is important - it tells PAM this module's
success or failure has no bearing on whether the login proceeds.

Restart nothing - PAM config is read per-session, so your next SSH login
will trigger it. Test with a login from another terminal window; you
should get a Telegram message within a couple of seconds.

What this doesn't cover (and what would)

This gets you real-time visibility. It doesn't get you:

Geolocation on the source IP - doable with a free IP lookup API, left out here to avoid a third-party dependency by default (and for privacy - you're now sending login IPs to another service).
"New device" flagging - tracking previously-seen IPs and flagging first-time sources needs a small persistent IP list, easy to add.
Fail2Ban ban alerts, sudo usage alerts, disk-full alerts - same pattern, different trigger. PAM's pam_exec only covers auth events; these need to hook into sudo's own PAM stack or a cron check.

If you want all of that plus the rest of the hardening that should happen
before you ever expose SSH to the internet - non-root user setup, UFW,
Fail2Ban jails, automatic SSL - that's the larger tool this is one module
of: ServerSecure Setup. This snippet is the full
signature feature, free, because it costs me nothing to give away and it's
the best proof I can offer that the rest of the tool is built with the
same care.

Questions or found an edge case? Drop a comment - I read and reply to
every one.

Why Most Cafe Websites Feel Outdated (And How I Fixed It)

Ardiansyah Sulistyo — Tue, 19 May 2026 08:09:52 +0000

Most cafe websites still look like generic business templates from 2016.

Bright backgrounds, cluttered layouts, autoplay sliders, weak typography, and mobile experiences that feel like an afterthought.

I wanted to create something that feels modern, cinematic, and mobile-first — more like a premium app experience than a traditional website.

So I built Noir & Brew, a premium Astro landing page template for modern coffee shops and creative F&B brands.

The Problem With Most Cafe Websites

Most cafe websites follow the same pattern:

Generic layouts
Poor mobile navigation
Weak visual hierarchy
Overcrowded sections
Inconsistent branding
Slow performance
Outdated UI patterns

The result?

They don’t feel memorable.

And for cafes, atmosphere matters just as much as the product itself.

A website should communicate the same feeling customers get when they walk into the space:

warm lighting
premium ambiance
calm atmosphere
intentional branding

That became the core direction behind this project.

Designing Around Atmosphere

Instead of focusing only on information density, I focused on visual mood and presentation first.

The design direction was inspired by:

editorial layouts
luxury hospitality brands
cinematic dark interfaces
premium coffee packaging
modern mobile app navigation

I intentionally used:

dark backgrounds
warm gold accents
oversized typography
immersive cards
spacious layouts
minimal UI noise

The goal was simple:

Make the website feel premium before users even start reading.

Mobile-First Was the Priority

Most restaurant traffic comes from mobile devices.

But many templates still treat mobile as a scaled-down desktop layout.

I did the opposite.

I designed the mobile experience first:

bottom navigation
app-like interaction
compact content blocks
thumb-friendly spacing
immersive promo sections
simplified menu browsing

Only after the mobile structure felt complete did I expand the design into desktop.

That decision alone made the experience feel significantly more modern.

Tech Stack

I wanted the template to stay lightweight while still feeling interactive.

Stack Used

Astro
React
Tailwind CSS v4
Framer Motion

Why Astro?

Astro gives excellent performance out of the box while still allowing interactive islands where needed.

That means:

fast initial load
less JavaScript shipped
SEO-friendly pages
smoother interactions

For content-focused websites like cafes, portfolios, and hospitality brands, this architecture works extremely well.

Features

The template currently includes:

Responsive landing pages
Mobile-first layouts
Interactive menu section
Promo showcase
Contact & location pages
3 built-in themes
SEO-ready structure
Easy customization
Production-ready codebase

Designed for:

cafes
coffee shops
restaurants
hospitality brands
creative studios

Challenges During Development

One of the hardest parts was balancing aesthetics with readability.

Dark luxury interfaces can easily become:

too low contrast
visually noisy
difficult to scan

I had to simplify multiple sections repeatedly before the interface finally felt clean enough.

Another challenge was avoiding over-animation.

Modern websites often animate everything.

Instead, I focused on:

subtle transitions
layered depth
hover feedback
visual rhythm

That helped the UI feel calmer and more premium.

Final Thoughts

I think websites for physical spaces should feel emotional — not just functional.

Especially for cafes.

People don’t only buy coffee.

They buy atmosphere, identity, and experience.

That’s what I tried to translate into this template.

Live Demo

🔗 Demo:
Noir & Brew Demo

🔗 Gumroad:
Noir & Brew Template

I built a minimal company profile template because I was tired of colorful noise

Ardiansyah Sulistyo — Fri, 20 Feb 2026 07:33:36 +0000

🔗 Live demo: https://mono-profile-alpha.vercel.app/

I have a problem with most website templates.

They're loud. Gradients everywhere, hero sections with three different
typefaces, accent colors fighting each other. I get it they want to
look impressive in a marketplace thumbnail.

But when I actually need to use one? It's exhausting.

I like monochrome. Black, white, grays, maybe one muted accent.
Clean type. Room to breathe. So after saying "I'll just build my own"
for the fifth time, I actually did.

This is MONO, a minimal company profile template I built for myself
and ended up packaging for anyone else who thinks the same way.

The stack

I went with what I'm comfortable with, and what I'd actually want
to inherit from someone else:

Vite — fast dev server, no config hell
React + TypeScript — predictable, easy to extend
Tailwind CSS — utility-first, no surprise CSS specificity
shadcn/ui — accessible components without opinionated styling

Shadcn was actually the right call here. Since the components are
unstyled by default and live in your codebase, the monochrome
aesthetic doesn't fight the component library. You're not overriding
a blue primary button everywhere.

What's in the template

It's a typical company profile page, but intentionally stripped down:

Hero (headline, subtext, CTA)
Services / what you offer
Selected work / portfolio
About section
FAQ
Contact

That's it. No unnecessary animations, no scroll-jacking, no
"surprise me" interactions.

The section order makes sense for most businesses: tell me who you
are → what you do → proof you've done it → answer my obvious
questions → let me reach you.

The design decision I'm most glad I made

I almost added a color theme switcher. "Users can pick an accent
color!" Sounds useful, right?

I removed it.

Not because it's hard to build it's not. But it introduces
decisions. "Should I use purple or teal?" is exactly the kind of
question I want the template to eliminate, not create.

Monochrome is a decision. Stick to it.

If you want a specific accent later, you change one Tailwind CSS
variable and you're done. That's intentional.

Who this is for

Honestly? Anyone who needs a company profile that looks professional
without spending a week on design decisions.

That includes:

Agencies putting together a quick client-facing profile
Freelancers who want a site that looks serious
Developers who'd rather write code than pick color palettes
Someone building a startup landing page before they figure out branding

It's not a dashboard, not a SaaS template, not a landing page with
17 sections. Just a company profile. Done well.

If you want to grab it

It's on Gumroad: [https://aardnsyhs.gumroad.com/l/mono-company-profile]

Comes with the full source code, clean folder structure, and a README
that explains how to customize the key parts without touching
everything.

If you check it out or if you've built something similar I'd love
to hear what you think. What's the one thing you always end up
rebuilding when you use someone else's template?