Sunday, February 26, 2017

Automatically send email when someone login server as ROOT

E-mail Alert on Root SSH Login 

  1.  Login to the server via SSH using root
  2.  cd /root
  3.  vi .bash_profile
  4.  At the end of the file add the following line:

echo 'ALERT - Root Shell Access (YourserverName) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d"(" -f2 | cut -d")" -f1`" you@yourdomain.com

(or)



  1. Login to your linux using root user.
  2. go to /root directory by typing cd /root command.
  3. open .bashrc file for editing. You can do this by command vi .bashrc
  4. Scroll to the end of the file add add following line and same the file and log out to your ssh panel.
echo 'ALERT - Root Shell Access (servername) on:' `date` `who` | mail -s "Alert: Root Access"  email@domain.com
Replace servername by your name of server. Replace email@domain.com by your email on which you want to receive the email alert.Once you will login back to your server using root user. You will receive an email.
It sends you the email alert when somebody login through root because when you login to your root user via ssh by default batch file .bashrc get executed. So every time the file .bashrc get executed you will received an alert.

No comments:

Post a Comment