Covert Login Alerting

The post describes a defensive technique to detect use of compromised or canary credentials on Linux SSH by integrating a PAM hook (`pam_script`) that triggers a CanaryToken when specified credentials are attempted. It covers compiling and installing `pam_script`, adding `auth optional pam_script.so` to `/etc/pam.d/sshd`, and deploying a simple shell script that curls a token on authentication events to enable low-infrastructure alerting of suspicious login attempts.