For notifications about new SSH logins please create file /etc/profile.d/notify.sh (tested and used only in CentOS 6)

1
2
# Create new file
vim /etc/profile.d/notify.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
#!/bin/sh
IP="$(echo $SSH_CONNECTION | cut -d " " -f 1)"
LOGIN_TIME=$(date +"%d.%m.%Y %H:%M:%S")
LOGIN_USER=`whoami`
HOSTNAME=`hostname`
SUBJECT="SSH Login Notification - $HOSTNAME/$LOGIN_USER"
TO_EMAIL="youremailadres@maildomain.com"
 
if [ -z $IP ] ;
        then IP="localhost"
fi
# Whitelisted (safe) IP addresses
WHITELIST="192.168.168.168 192.168.167.166"
 
if [ `echo $WHITELIST | grep $IP | grep -v grep | wc -l` -eq 1 ] ; then
        EMAIL_MESSAGE="${LOGIN_TIME}: SSH LOGIN_USER $LOGIN_USER has login from $IP (VPN or local) on $HOSTNAME"
        echo $EMAIL_MESSAGE >> "/tmp/${LOGIN_USER}_logins.log" #TEMP LOG
else
        EMAIL_MESSAGE="${LOGIN_TIME}: SSH LOGIN_USER $LOGIN_USER has login from $IP on $HOSTNAME"
        echo $EMAIL_MESSAGE >> "/tmp/${LOGIN_USER}_logins.log" #TEMP LOG
        echo "$EMAIL_MESSAGE" | mail -s "$SUBJECT" $TO_EMAIL
fi
1
2
# Give execute permission to file
chmod +x /etc/profile.d/notify.sh