12/04/2016

SSH login – email notifications about new logins

Компјутераш блог HowTo

For notifications about new SSH logins please create file /etc/profile.d/notify.sh (tested and used only in CentOS 6)

# Create new file with content bellow
vim /etc/profile.d/notify.sh

#!/bin/sh
IP="$(echo $SSH_CONNECTION | cut -d " " -f 1)"
LOGIN_TIME=$(date +"%d.%m.%Y %H:%M:%S")
LOGIN_USER=`whoami`
HOSTNAME=`hostname`
SUBJECT="SSH Login Notification - $HOSTNAME/$LOGIN_USER"
TO_EMAIL="youremailadres@maildomain.com"

if [ -z $IP ] ;
        then IP="localhost"
fi
# Whitelisted (safe) IP addresses
WHITELIST="192.168.168.168 192.168.167.166" 

if [ `echo $WHITELIST | grep $IP | grep -v grep | wc -l` -eq 1 ] ; then
        EMAIL_MESSAGE="${LOGIN_TIME}: SSH LOGIN_USER $LOGIN_USER has login from $IP (VPN or local) on $HOSTNAME"
        echo $EMAIL_MESSAGE >> "/tmp/${LOGIN_USER}_logins.log" #TEMP LOG
else
        EMAIL_MESSAGE="${LOGIN_TIME}: SSH LOGIN_USER $LOGIN_USER has login from $IP on $HOSTNAME"
        echo $EMAIL_MESSAGE >> "/tmp/${LOGIN_USER}_logins.log" #TEMP LOG
        echo "$EMAIL_MESSAGE" | mail -s "$SUBJECT" $TO_EMAIL
fi

# Give execute permission to file
chmod +x /etc/profile.d/notify.sh