E-mail Alert on Root SSH Login

[nileshparmar]

Want to be notified instantly when someone logs into my server as root
With date time & local IP address
Is it possible to do this thing?

[PlatinumServerM]

Sure you can do this /root/.bashrc

[ChrisRHS]

Take a look at my blog post:
SolidServers.ca » Blog Archive » More SSH security

[nileshparmar]

Originally Posted by PlatinumServerM

Sure you can do this /root/.bashrc

what can i do to this /root/.bashrc

[Infopro]

LFD does this. You might want to take a look at your CSF configuration. This is covered there along with email alerts for many other things as well.

No need to edit that file, IMHO..

[nileshparmar]

Originally Posted by Infopro

LFD does this. You might want to take a look at your CSF configuration. This is covered there along with email alerts for many other things as well.

No need to edit that file, IMHO..

what exact to look in CSF configuration

[nileshparmar]

after lot of googling i got below

& its really doing great job

So lets get started!

1. Login to your server and su to root, I know the irony!

2. cd /root

3. pico .bashrc

4. Scroll to the end of the file then add the following:
echo 'ALERT - Root Shell Access (YourserverName) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d"(" -f2 | cut -d")" -f1`" you@yourdomain.com

Replace YourServerName with the handle for your actual server
Replace you@yourdomain.com with your actual email address

5. Crtl + X  then Y

Now logout of SSH, close the connection and log back in! You should receive an email address of the root login alert a few minutes afterwards.