CentOS: E-mail notification of failed ssh login attempts

Question

Under CentOS, I need a script that will run every 10 minutes and e-mail me if there are any new failed ssh login attempts in /var/log/secure.

Answer 1

Why not considering to use fail2ban or SSHGuard. Fail2ban seems configurable to send emails. These are better than any script written within 5 or 10 minutes.

Also, such solutions can protect you other than just sending emails.

Answer 2

You could use Logcheck for "analysing" specific logs and it sends periodically emails to you. Of course, some configuration is necessary. On Debian systems installed via aptitude install logcheck it checks /var/log/syslog and /var/log/auth.log per default. But adding other logs and configuration the search strings via RegEx (?) is kind of easy.

Please read the notice on the download page:

Note: For installation on platforms other than Debian, download the latest tarball using the source package links found on the logcheck package page