Email when someone ssh's into a server
Save the following file to /etc/profile.d/ssh-alerts.sh
on your server.
Update [email protected] with your email.
# email on ssh login
if [ -n "$SSH_CLIENT" ]; then
TEXT="$(date): ssh login to ${USER}@$(hostname -f)"
TEXT="$TEXT from $(echo $SSH_CLIENT | awk '{print $1}')"
echo $TEXT | mail -s "ssh login" [email protected]
fi
Now on yours, and any other user ssh, you'll get an email (assuming you have email setup already with mailutils etc)
The email will look like this, showing the user, which server and their IP (where I've changed the IP to 1.2.3.4 and hostname of the server to my-server-name for the purposes of this screenshot):
comments powered by Disqus