shell alert by mail in linux server

important note
this is a working example of getting shell alerts by mail. it's not recommended to use as is on production environments.

install msmtp packages to send mails.
apt update; apt install -y msmtp msmtp-mta

♦
customize settings by execute nano .msmtprc (or with your favorite editor) at ~.
defaults
auth           on
tls            on
tls_trust_file /etc/ssl/certs/ca-certificates.crt
logfile        /var/log/msmtp.log

account service
host mail.zurrak.com
port 587
from <from_user>@zurrak.com
user <from_user>@zurrak.com
password <redacted>

account default : <from_user>

♦
put this bash script to somewhere. you'll need its path for pam. mine is at ~. also don't forget to chmod +x or chmod 755 it.
#!/bin/bash

if [[ "$PAM_TYPE" == "close_session" ]]; then
    exit 0
fi

myip="<put_your_ip_to_be_dismissed>" #i.e: your home ip address that connecting from, everyday

if ! [[ -n $(lsof -i -n -P 2>/dev/null | grep -E 'sh|bash|nc|perl|python|php' | grep -vE 'shell2htt|ssh|mbsync' | grep -- '->') ]]; then
    echo "pass"
else
    echo -e "Subject: reverse shell access on $(hostname)\n\n\
shell session opened:\n\
user: $(lsof -i -n -P 2>/dev/null | grep -E 'sh|bash|nc|perl|python|php' | grep -vE 'shell2htt|ssh' | awk '{print $3}' | sort -u)\n\
tty: noninteractive\n\
ip: $(lsof -i -n -P 2>/dev/null | grep -E 'sh|bash|nc|perl|python|php' | grep -vE 'shell2htt|ssh' | awk '{print $9}' | sort -u | cut -d '>' -f2)\n\
time: $(date "+%Y-%m-%d %H:%M:%S")\n" | msmtp -a <from_user> <to_user>@zurrak.com
fi

if [[ -n $(w | grep -v "$myip") ]] || [[ -n $(ps -eo user,tty | awk '{print $2}' | grep -vE '\?|tty1|ttyS0|TT' | sort -u | grep -Fxf - <(who | grep -v "$myip" | awk '{print $2}')) ]]; then
#if ! ( who | grep -v "$myip" >/dev/null 2>&1 ) || ( ps -eo user,tty | awk '{print $2}' | grep -vE '\?|tty1|ttyS0|TT' | sort -u | grep -Fxf - <(who | grep -v "$myip" | awk '{print $2}') ); then
    echo "pass2"
else
    echo -e "Subject: shell access on $(hostname)\n\n\
shell session opened:\n\
user: $(w -h | grep -v "$myip" | awk '{print $1}')\n\
tty: $(w -h | grep -v "$myip" | awk '{print $8}')\n\
ip: $(w -h | grep -v "$myip" | awk '{print $2}')\n\
time: $(date "+%Y-%m-%d %H:%M:%S")\n" | msmtp -a <from_user> <to_user>@zurrak.com
fi

♦
adjust pam by nano /etc/pam.d/common-session. put this line at the end of file then save it.
session required pam_exec.so /root/shellalert.sh

♦
generating alert:



incoming mail:



let's roll!