Enable email alert when wheel group user logs in?

[sadasan]

Hello,

I had csf plug in installed and added a wheel user "test(just example)" from WHM.

I configured the server to send an email alert when the user "test" succeeds to login as a root.

It works as follows.
Log in to the server by user "test" first, then su - to root.

I tried, however, the server sent the email alert when only root login succeeds, it is too late.

I want that the server sends the alert email when a wheel user of "test" succeeds to login, then I could know that a hacker broke a user password, but they had not succeeded to log in by root yet.

To enable the email alert when server login succeeds in user level, where may I configure of csf?

Any advice would be appreciated.

Thank you.

 

[cPanelLauren]

Hello @sadasan

CSF/LFD offers a LF_SSH_EMAIL_ALERT which as described in the configuration file is as follows:

Send an email alert if anyone logs in successfully using SSH

SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read
this file about RESTRICT_SYSLOG before enabling this option:

LF_SU_EMAIL_ALERT would also notify whether the attempt was successful or not:

Send an email alert if anyone uses su to access another account. This will
send an email alert whether the attempt to use su was successful or not

SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read
this file about RESTRICT_SYSLOG before enabling this option: