E-mail Alert on Root SSH Login Published: Dec 08, 2003

• Rating

  4/5

Comments (16)

• 
  Edward 07:05, December 9, 2003

  Loved it worked like a charm, but I had to make the entire code into one line instead of a 3 line code not sure why.
• 
  Chris 22:34, December 19, 2003

  I am trying to do this but get a mail command not found when I login after doing this. cpanel/RH9
  
  Any ideas what I might be doing wrong?
• 
  C0NIk 17:15, March 16, 2004

  it's cool one but sometime dont work with the Red Hat Entrprise 3
  
  so if it didnt work it will be easy to install LogWatch
• 
  Jimmy B Silva II 10:20, March 27, 2004

  Make sure you put in a single line like Edward did. It should work for Red Hat Enterprise 3
• 
  jad madi 15:46, May 20, 2004

  use echo -n for better
  so none will notice that there is a monitoring for login
  
• 
  JLChafardet 19:36, November 2, 2004

  It worked like charm on my RHEL ES3 box, will see if it sends mails every root try.<br />
  <br />
  any way it is most recomended that you forbid direct root logins.
• 
  Holoken 20:53, July 17, 2005

  If the attacker's clever then it won't work. Instead of logging in like Joe Admin would, he'll tell ssh to execute the following command: "ssh user@example.com /bin/bash --noprofile --norc". This'll bypass the mail-sending script in /root/.bashrc, and we'll be none the wiser.<br />
  <br />
  Put it instead in /root/.ssh/rc which is executed before any command (including any login shell) is run. This way the attacker's login will not go undetected even if he uses the above method to get in.<br />
  
• 
  Arif Kanji 19:22, August 9, 2005

  Awesome!<br />
  How do u code to get alerts only for users who have entered incorrect username and/or password?<br />
  <br />
  Thanx
• 
  Clayton 21:40, October 23, 2005

  Hi,<br />
  I couldn't see .bashrc anywhere in my /root what should i do.<br />
  <br />
  Thanks<br />
  Regards,<br />
  CEO NightShells.NeT
• 
  BitSurFer 16:38, July 11, 2006

  somthing wrong!!<br />
  when i login i get this error<br />
  ----------------------------<br />
  cut: you must specify a list of bytes, characters, or fields<br />
  Try `cut --help' for more information.<br />
  -bash: -f1: command not found<br />
  ----------------------------
• 
  Dave 16:55, March 15, 2007

  BitSurFer,<br />
  <br />
  Try replacing:<br />
  `who | cut -d"(" -f2 | cut -d")" -f1`<br />
  <br />
  with:<br />
  `whoami`<br />
  <br />
  It should do the same thing.<br />
  
• 
  JACOB 10:50, April 10, 2008

  I CAN'T SEE WHERE IT IS WRITTEN - "echo 'ALERT - Root Shell Access (YourserverName) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d"(" -f2 | cut -d")" -f1`" you@yourdomain.com" <br />
  <br />
  
• 
  Phil 17:29, May 15, 2008

  For FreeBSD users, edit the /root/.cshrc file and add the line as follows:<br />
  <br />
  echo 'ALERT - Root Shell Access on:' `date` `who` | mail -s "Alert: Root Access from `whoami`" yourname@your.email<br />
  <br />
  This should all be one line and should probably be added to the end of the file.<br />
  <br />
  
• 
  Paul Brady 21:11, September 9, 2008

  I can only get this tip to work if I enter:<br />
  # source .bash_profile<br />
  <br />
  to source the file. When I do that, I get an email. When I log out, however, and then log back in (using su) I get no alert by email.<br />
  Am I missing something? I've been banging my head on the wall for hours. Can someone help? :-)<br />
  
• 
  ubaid 00:49, September 23, 2008

  can we add the IP address of the machine whom we login or just like the message we get when we login to root user
• 
  ericinwisconsin 15:59, July 1, 2009

  An elegant solution, yes, but also prevent root from logging in at all. Add this line:<br />
  <br />
  AllowUsers <i>username</i><br />
  <br />
  to your sshd_config file.<br />
  <br />
  For us Debian (and probably Ubuntu) users, the file it at /etc/ssh/sshd_config<br />
  <br />
  You can issue an "su" command to become root. I NEVER allow root direct ssh access to a box, but I do also use the technique on this page to make sure. I also limit ssh access only from certain other boxes on important servers and routers.<br />