How to Get Linux Server Sends Email Alert on Root Login
To improve the security of the server, especially web server which exposes to the Internet and possible worldwide hackers, it’s best to enable server to automatically send a notification email to predefined email address everytime someone logs in as root to the host. To configure the automatic email alert notification to a default email address on each incident of root log on on the server, use the following guide.
- Login to the server via SSH using as root ID.
- Ensure that you’re at home directory of root. The open up the .bash_profile for editing using pico or vi by typing one of the following commands at command shell line:
pico .bash_profile
vi .bash_profile - Scroll down to the end of the file and add the following line:
echo 'ALERT - Root Shell Access on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d"(" -f2 | cut -d")" -f1`" user@example.com
Replace user@email.com with the actual email account address that you want to the root access alert notification been sent to. Note that you can change the text contains in the email alert too. The text starting with first ALERT is written as email body, and you can add in other info such as host name or change the wordings. The second Alert is the email title which you can change to your own too.
Now logout and login again as root, you should receive an email alert at your inbox. The security trick should works on most popular flavor of Linux such as RedHat, CentOS, Ubuntu, FreeBSD and etc.
Related Articles
- Disable Direct Root Login and User Access via SSH to Server
- Disable and Turn Off Telnet in Linux
- Change and Reset MySQL root Password
- Cannot FTP to Web Host or Server running cPanel/WHM
- Change User Name on Linux
- cPanel Invalid License File After Changing Hostname Error
- Scott’s Gmail Alert – Email Alert System for Gmail Accounts
- Installing Web Server in FreeBSD 6.0 with Apache 2.2, MySQL 5.0 and PHP 5 – Part 3
- Account Locks Out Due to Brute Force Protection in cPanel WebHost Manager (WHM)
- Check and Optimize MySQL Database Automatically with Crontab/Cron
Entries (RSS)
December 22nd, 2009 01:11
Also, it should be known that if anyone was attempting to get root access to your system, the “bash” shell probably wouldnt be loaded. They would probably go for the lower of “sh”.
December 22nd, 2009 01:10
Hi,
Before finding this article, I had already started to try to implement this myself. I did basic security testing to it and I found that you can very very easily bypass this by executing the “sh” command which bypasses the “bash” command to load the shell and therefore, .bash_profile and .bashrc both get bypassed.
Use this at your own risk and don’t assume its a guarantee. Another way to possible implement such feature is to rewrite the code for openSSH and implement it directly into the code.
November 21st, 2008 03:41
Great stuff,
Is there a way to have the IP of the person who logs in show up?
November 1st, 2008 03:06
This works for root login or su – from a user login.
How can I implement it that will work also for “su” only? Right now since the path will change with su instead of su – it will not send an email if someone is not using the “-” after the su. Thanks.
May 3rd, 2008 05:43
‘who -m’ makes the output much cleaner when using this on a system that has multiple users logged on…
-m reports only hostname and user associated with stdin terminal
August 12th, 2007 03:10
[...] Linux – wysyłanie maila o logowaniu na konto roota Bardzo użyteczny skrypcik [...]