I've implemented a login-notify script in /etc/ssh
The script will notify me via Microsoft Teams when there is a login to my VM, with the user, host and service
However - it appears the rhost is sometimes behind For example a user ssh'd onto the machine at 8:06, the ip reported was mine, and not his. Then at 10:06 i ssh'd onto the machine, and the ip reported was his and not mine - so it's as if the rhost is always one behind
Has anyone else had this issue? or know how to solve please?
EDIT - Here is the script
#!/bin/sh
if [ "$PAM_TYPE" != "close_session" ]; then host="`hostname`" curl -H "Content-Type: application/json" -d "{\"text\": \"SSH Login: User -'$PAM_USER' On - '$host' from $PAM_RHOST\"}" [MS_TEAMS_HOOK
fi
