How to Get Linux Server Sends Email Alert on Root Login

To improve the security of the server, especially web server which exposes to the Internet and possible worldwide hackers, it’s best to enable server to automatically send a notification email to predefined email address everytime someone logs in as root to the host. To configure the automatic email alert notification to a default email address on each incident of root log on on the server, use the following guide.

  1. Login to the server via SSH using as root ID.
  2. Ensure that you’re at home directory of root. The open up the .bash_profile for editing using pico or vi by typing one of the following commands at command shell line:

    pico .bash_profile
    vi .bash_profile

  3. Scroll down to the end of the file and add the following line:


    echo 'ALERT - Root Shell Access on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d"(" -f2 | cut -d")" -f1`" user@example.com

    Replace user@email.com with the actual email account address that you want to the root access alert notification been sent to. Note that you can change the text contains in the email alert too. The text starting with first ALERT is written as email body, and you can add in other info such as host name or change the wordings. The second Alert is the email title which you can change to your own too.

Now logout and login again as root, you should receive an email alert at your inbox. The security trick should works on most popular flavor of Linux such as RedHat, CentOS, Ubuntu, FreeBSD and etc.


4 Responses to “How to Get Linux Server Sends Email Alert on Root Login”

  1. dean
    November 21st, 2008 03:41
    4

    Great stuff,

    Is there a way to have the IP of the person who logs in show up?

  2. Emilio
    November 1st, 2008 03:06
    3

    This works for root login or su – from a user login.
    How can I implement it that will work also for “su” only? Right now since the path will change with su instead of su – it will not send an email if someone is not using the “-” after the su. Thanks.

  3. Jon
    May 3rd, 2008 05:43
    2

    ‘who -m’ makes the output much cleaner when using this on a system that has multiple users logged on…

    -m reports only hostname and user associated with stdin terminal

  4. Linux - wysyłanie maila o logowaniu na konto roota « Barni.LOG
    August 12th, 2007 03:10
    1

    [...] Linux – wysyłanie maila o logowaniu na konto roota Bardzo użyteczny skrypcik [...]

Leave a Reply

You can use these tags: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Subscribe to comments feature has been disabled. To receive notification of latest comments posted, subscribe to My Digital Life Comments RSS feed or register to receive new comments in daily email digest.
Custom Search

New Articles

Incoming Search Terms for the Article

linux mail change from address - linux login email notification - linux set root email - linux send mail on login - linux user login mail alert - linux set user email - linux root email address - linux email log - linux email alert - mail linux change from - email notification when a user logs in linux - linux user login email - root login notify - configure linux to send email alerts - wordpress blogs - linux remote login notify - linux root email - Alert: Root Access from - set root mail - root email address - root mail linux - linux get administrator e-mail address - linux mail root - linux send email when user login - how can I have alert everytime if someone login my server via root user - how to mail alerts linux - how to get linux mail - linux alert on new login - linux - notify when user logs in ssh linux - linux mail alerts - linux mail change from - linux send root mail - linux login notification - Receive an email when someone logs in as root - email alerts linux - linux notify root login - linux send mail login - linux root user email address - linux change "root email address" - linux sending emails with root account how to - mail.arabian-roots.com\\exchange - send alert from linux mail - linux login notify - notify to email when accessing to linux server - change root email - configure linux to send alert emails - email alert linux - linux alert trigger email - linux alert -