UNIX for Advanced & Expert Users

#!/bin/sh
# startdate: 2018-10-05 13:20
# Purpose: if a service account user logs in interactively, then kill it.
# incomplete. Can be foiled with: ssh -t clonetest210 /bin/bash
# improve: how to retrieve log entries to check

# Sample journalctl output.
# Oct 05 13:12:52 clonetest210 sshd[1868]: Starting session: shell on pts/3 for bgstack15-local from 10.200.18.240 port 59349 id 0

# Dependencies: sshd_config LogLevel VERBOSE
# journalctl -f -u sshd is not sufficient. I cannot tell what unit logs the notice seen above.

BADUSERS="(bgstack15-local|prophetess)"

journalctl -n100 | grep -oE "sshd\[.{1,10}\]: Starting session: shell on .* for ${BADUSERS} from .*" | awk '{print $1,$6,$8,$10}' | while read longpid tty tu srcip ;
do
   pid="$( echo "${longpid}" | tr -dc "[:digit:]" )"
   echo "Found login: ${tu} from pid ${pid} from ip ${srcip} and made terminal ${tty}"

   # investigate that current pid. if it exists and is sshd, kill it
   psout="$( ps -e -o pid:9,ppid:9,user:15,command:90 2>/dev/null | awk "\$1 == $pid" )"
   if test -n "${psout}" && echo "${psout}" | grep -qE "sshd:" ;
   then
      echo "need to warn user ${tu} on tty ${tty} and then kill pid ${pid}"
      printf "\n%s\n" "Interactive sessions are not allowed for user ${tu}." > "/dev/${tty}"
      sleep 0
      kill "${pid}"
   fi
done