How to Get Root and User SSH Login Email Alerts

Whenever we install, configure, and secure Linux servers in a production environment, it’s very crucial to keep track of what is happening with servers and who logs into the server as far as concerned about the security of the server.

Why, because if someone logged into server as root user using brute force tactics over SSH, then think about how he will destroy your server. Any user who gains root access can do whatever he wants. To block such SSH attacks, read our following articles that describes how to protect servers from such attacks.

1. Block SSH Server Brute Force Attacks Using DenyHosts
2. Use Pam_Tally2 to Lock and Unlock SSH Failed Logins
3. 5 Best Practices to Secure and Protect SSH Server

So, it’s not a good practice to allow direct root login via SSH session and recommend to create non root accounts with sudo access. Whenever root access needed, first logged in as normal user and then use su to switch over to root user. To disable direct SSH root logins, follow our below article that shows how to disable and limit root login in SSH.

1. Disable SSH Root Login and Limit SSH Access

However, this guide shows a simple way to know when someone logged in as root or normal user it should send an email alert notification to the specified email address along with the IP address of last login. So, once you know the IP address of last login made by unknown user you can block SSH login of particular IP address on iptables Firewall.

1. How to Block Port in Iptables Firewall

How to Set SSH Login Email Alerts in Linux Server

To carry out this tutorial, you must have root level access on the server and a little knowledge of nano or vi editor and also mailx (Mail Client) installed on the server to send the emails. depending upon your distribution you can install mailx client using one of the following commands.

On Debian/Ubuntu/Linux Mint

# apt-get install mailx

On RHEL/CentOS/Fedora

# yum install mailx

Set SSH Root Login Email Alerts

Now login as root user and go to root’s home directory by typing cd /root command.

# cd /root

Next, add an entry to the .bashrc file. This file sets local environment variables to the users and does some login tasks. For example, here we setting a an email login alert.

Open .bashrc file with vi or nano editor. Please remember .bashrc is a hidden file, you won’t see it by doing ls -l command. You’ve to use -a flag to see hidden files in Linux.

# vi .bashrc

Add the following whole line at the bottom of the file. Make sure to replace “ServerName” with a hostname of your Server and change “[email protected]” with a your email address.

echo 'ALERT - Root Shell Access (ServerName) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d'(' -f2 | cut -d')' -f1`" [email protected]

Save and close the file and logout and log back in. Once you login via SSH, a .bashrc file by default executed and sends you an email address of the root login alert.

Sample Email Alert

ALERT - Root Shell Access (Database Replica) on: Thu Nov 28 16:59:40 IST 2013 tecmint pts/0 2013-11-28 16:59 (172.16.25.125)

Set SSH Normal User Login Email Alerts

Login as normal user (tecmint) and go to user’s home directory by typing cd /home/tecmint/ command.

# cd /home/tecmint

Next, open .bashrc file and add the following line at end of the file. Make sure to replace values as shown above.

echo 'ALERT - Root Shell Access (ServerName) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d'(' -f2 | cut -d')' -f1`" [email protected]

Save and close the file and logout and login again. Once you login back again, a .bashrc file executed and sends you an email address of the user login alert.

This way you can set an email alert on any user to receive login alerts. Just open the user’s .bashrc file which should located under the user’s home directory (i.e. /home/username/.bashrc) and set the login alerts as described above.