Email when someone ssh's into a server

Save the following file to /etc/profile.d/ssh-alerts.sh on your server.
Update [email protected] with your email.

# email on ssh login
if [ -n "$SSH_CLIENT" ]; then  
    TEXT="$(date): ssh login to ${USER}@$(hostname -f)"
    TEXT="$TEXT from $(echo $SSH_CLIENT | awk '{print $1}')"
    echo $TEXT | mail -s "ssh login" [email protected]
fi  

Now on yours, and any other user ssh, you'll get an email (assuming you have email setup already with mailutils etc)

The email will look like this, showing the user, which server and their IP (where I've changed the IP to 1.2.3.4 and hostname of the server to my-server-name for the purposes of this screenshot):

comments powered by Disqus
Want to setup your own server? Digital Ocean offer $100 free for new accounts.
DigitalOcean Referral Badge