Enable email alert on SSH login

If you are the only person who should be connecting to a server or are a member of a team who needs to audit who is logging into a server, you can easily have the server send an email upon login to a user account.

This should not be relied upon as a security measure, however it is a very good tool to confirm who/when logins are occurring.

How to

Add the following line (with appropriate edits to the email address) to the end of your profile file (normally /etc/profile):

echo 'ALERT - Root Shell Access on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d"(" -f2 | cut -d")" -f1`" <[email protected]>

Leave a Reply

Your email address will not be published. Required fields are marked *