Even if it is too late when someone else logs in as root on your server, it is good to know that NOW is the time to get working on your security.
To setup email notification, login to your server as root.
Edit .bashrc
nano .bashrc
add the following line at the end, changing “ServerName” to the hostname of your server and “email@thisaddress.com” to your own email address.
echo 'ALERT - Root Shell Access (ServerName) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d"(" -f2 | cut -d")" -f1`" email@thisaddress.com
Save and exit.
Next time someone (hopefuly you) logs on as root, you will get an email about this.
This can be done for any user, you only have to make sure that the user can email out from your server.
mail -s “Alert: Root Access from `who | cut -d”(” -f2 | cut -d”)” -f1`” myemail@mydomain.com
doesn’t seem to works
it just stuck there when i call mail
do i need additional setting for mail to work?
You need an MTA to be able to send emails, If you look at the post about MINSTALL, you can easily install Exim and use that.
If you really want to save on resources, use the Dragonfly Mail Agent (dma). It will send messages without listening on port 25, ref. http://leaf.dragonflybsd.org/cgi/web-man?command=dma§ion=8
check steve81′s squeeze repo @ LET for a .deb
Really nice, wasn’t aware of dma before.
With that you could use an external relay like google mail or something similar.
Good find
[...] http://www.lowendguide.com/email/email-notification-when-someone-logs-in-via-ssh/ [...]
you shoult post your source next time
http://www.debian-tutorials.com/set-e-mail-alert-on-root-ssh-login
I would if I knew, the post was made from a thread on lowendtalk.com.
I’ll leave your comment here with the link to the site for you to feel better.