For notifications about new SSH logins please create file /etc/profile.d/notify.sh (tested and used only in CentOS 6)
# Create new file with content bellow
vim /etc/profile.d/notify.sh
#!/bin/sh IP="$(echo $SSH_CONNECTION | cut -d " " -f 1)" LOGIN_TIME=$(date +"%d.%m.%Y %H:%M:%S") LOGIN_USER=`whoami` HOSTNAME=`hostname` SUBJECT="SSH Login Notification - $HOSTNAME/$LOGIN_USER" TO_EMAIL="youremailadres@maildomain.com" if [ -z $IP ] ; then IP="localhost" fi # Whitelisted (safe) IP addresses WHITELIST="192.168.168.168 192.168.167.166" if [ `echo $WHITELIST | grep $IP | grep -v grep | wc -l` -eq 1 ] ; then EMAIL_MESSAGE="${LOGIN_TIME}: SSH LOGIN_USER $LOGIN_USER has login from $IP (VPN or local) on $HOSTNAME" echo $EMAIL_MESSAGE >> "/tmp/${LOGIN_USER}_logins.log" #TEMP LOG else EMAIL_MESSAGE="${LOGIN_TIME}: SSH LOGIN_USER $LOGIN_USER has login from $IP on $HOSTNAME" echo $EMAIL_MESSAGE >> "/tmp/${LOGIN_USER}_logins.log" #TEMP LOG echo "$EMAIL_MESSAGE" | mail -s "$SUBJECT" $TO_EMAIL fi
# Give execute permission to file
chmod +x /etc/profile.d/notify.sh