Get Notified With Every SSH Login
You can be notified every time someone logs into your server via ssh (secure shell).
Assuming your users run the bash shell, put the following in /etc/profile:
if [ -n "$SSH_CLIENT" ]; then
TEXT="$(date): ssh login to ${USER}@$(hostname -f)”
TEXT=”$TEXT from $(echo $SSH_CLIENT|awk ‘{print $1}’)"
echo $TEXT|mail -s "ssh login" you@your.domain
fi
How it works
The script /etc/profile is read at every login (assuming the bash shell is being used).
The test to the if command will ensure that this block of code only runs if the user logs in via ssh.
We then build the text of the message. $(date) will be replaced by the output of the date command; ${USER} will be replaced by the value of the USER environment variable; and $(hostname -f) will be replaced by the full hostname of the system being logged into.
The second TEXT line adds to the first, giving the IP address of the system this user is logging in from.
Finally, the text is sent in an email to your address.
