Home / server / Questions / 227629
In Process
Keith Palmer Jr.
Asked: 2011-01-28 06:58:58 +0800 CST

Send me an e-mail whenever someone logs in via SSH

  • 772

Is there a way to configure sshd so that it sends me an e-mail whenever someone logs in via SSH?

ssh

3 Answers

  1. Sshd itself won't do this for you, but you could probably accomplish what you want using the pam_exec module (assuming that you've got SSH using PAM). Something like this might work (in /etc/pam.d/sshd):

    session optional pam_exec.so /path/to/your/script

    You could also watch /var/log/secure (or your local equivalent) for messages sshd logs when someone logs in, and trigger and email based on that.

    You could also probably hack something together using the ForceCommand option in sshd. You would have ForceCommand run a script that would send the email and then use the SSH_ORIGINAL_COMMAND environment variable to run the user's shell (or whatever other command they were attempting to run). I only mention this because it might work, not because I think it's a good idea.

    • 3

  2. You could append this to the end of /etc/profile

    /bin/bash -c 'HN=`/bin/hostname`; IP=`/bin/hostname -i`; /bin/bash -c "/bin/hostname -i; /bin/hostname; echo; /usr/bin/who --ips; echo; /usr/bin/who --all" | /usr/bin/mailx -s "LOGIN ALERT - $HN ($IP)" root'

    This will email root with a list of logged in users everytime bash (the user's shell) is started.

    • 2

  3. You could use swatch (which is designed to watch logfiles and send emails with lines matching regexps) to monitor /var/log/secure (or wherever your OS logs ssh logins), looking for lines like

    sshd[xxxxx]: pam_unix(sshd:session): session opened for user foo by (uid=0)

    and sending mails accordingly.

    • 0