1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

E-mail Alert on Root SSH Login

Discussion in 'E-mail Discussions' started by crazyaboutlinux, Jun 3, 2009.

  1. crazyaboutlinux

    Joined:
    Nov 3, 2007
    Messages:
    930
    Likes Received:
    0
    Trophy Points:
    16
    Want to be notified instantly when someone logs into my server as root
    With date time & local IP address
    Is it possible to do this thing?
     
    #1 crazyaboutlinux, Jun 3, 2009
    Last edited: Jun 3, 2009
  2. ChrisRHS

    ChrisRHS Member

    Joined:
    Jul 12, 2006
    Messages:
    292
    Likes Received:
    5
    Trophy Points:
    18
  3. crazyaboutlinux

    Joined:
    Nov 3, 2007
    Messages:
    930
    Likes Received:
    0
    Trophy Points:
    16
    what can i do to this /root/.bashrc
     
  4. Infopro

    Infopro cPanel Sr. Product Evangelist
    Staff Member

    Joined:
    May 20, 2003
    Messages:
    12,118
    Likes Received:
    31
    Trophy Points:
    48
    Location:
    Pennsylvania
    LFD does this. You might want to take a look at your CSF configuration. This is covered there along with email alerts for many other things as well.

    No need to edit that file, IMHO..
     
  5. crazyaboutlinux

    Joined:
    Nov 3, 2007
    Messages:
    930
    Likes Received:
    0
    Trophy Points:
    16
    what exact to look in CSF configuration
     
  6. crazyaboutlinux

    Joined:
    Nov 3, 2007
    Messages:
    930
    Likes Received:
    0
    Trophy Points:
    16
    after lot of googling i got below

    & its really doing great job

    Code:
    
    So lets get started!
    
    1. Login to your server and su to root, I know the irony!
    
    2. cd /root
    
    3. pico .bashrc
    
    4. Scroll to the end of the file then add the following:
    echo 'ALERT - Root Shell Access (YourserverName) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d"(" -f2 | cut -d")" -f1`" you@yourdomain.com
    
    Replace YourServerName with the handle for your actual server
    Replace you@yourdomain.com with your actual email address
    
    5. Crtl + X  then Y
    
    Now logout of SSH, close the connection and log back in! You should receive an email address of the root login alert a few minutes afterwards.
    
     

Share This Page