Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I would like to be notified about each SSH connection to the Linux (Debian) server.

Already saw some methods, which proposed to add mail command into own .bashrc, but this approach seems not to cover all possible cases.

What is the best practice to make such transversal notifications about SSH connections ?

share|improve this question
    
How soon after the connection do you want to know? Do you want a daily report, or do you want an instantaneous e-mail? –  EightBitTony Jun 4 '12 at 14:53
1  
Define at what stage? TCP SYN, full handshake, auth / protocol / key negotiation, auth attempt, etc.? –  Jeff Ferland Jun 4 '12 at 14:55
    
@EightBitTony Both. 1.An instant email with IP/username. 2. Daily statistics about connection duration of each user, who was connected. –  Fedir Jun 4 '12 at 15:07
    
@JeffFerland This question is only about successful connections. Of course, an additional protection about each not-successful auth attempt should be configured. –  Fedir Jun 4 '12 at 15:11

5 Answers 5

Since you clarified that you want an email for each successful authentication, pam_notify is a great candidate module for this.

Add it as a session required line at the end of your /etc/pam.d/sshd or equivalent file.

share|improve this answer

The best practice is don't unless you REALLY have to (the security of this machine is THAT critical).

If you REALLY have to, you don't want to muck about with shell .rc files that people can change - that's a half-baked solution.

The Right Way is probably to use the audit facilities built into Linux (see the man pages for auditd, and its configuration file auditd.conf), but I have very limited experience with the audit facilities in Linux (in particular I'm not sure the audit subsystem makes it easy to send emails -- I know you can on FreeBSD without too much trouble though).

The less-right-but-still-decent way would be to use a PAM module that always succeeds and kicks out an email saying who tried to log in.

The least-right-but-at-least-your-inbox-isnt-full way would be to batch up your auth.log file or equivalent and email it to someone every night. If all you need is a basic record this would be my choice: The volume of email generated from my other suggestions would be heinous on a system with lots of activity.

share|improve this answer
    
Note per Jeff's comment there are lots of places you can audit the connection if you use the audit facilities -- right down to "attempted TCP connections to port 22", which would generate heinous amounts of audit data for any machine connected to the internet... –  voretaq7 Jun 4 '12 at 15:04

you can monitor your /var/log/auth.log periodically or even better make it remote logging so attacker cannot wipe out the trace of successful logging in.

share|improve this answer
    
I tried cat /var/log/auth.log | grep sshd, but it gives too much data, if there is a short way to make the data preprocessing, to make the data more readable ? –  Fedir Jun 4 '12 at 15:21
1  
@Fedir you can try something like this: code.google.com/p/linscripts/wiki/logmon –  pQd Jun 4 '12 at 15:29

Since this question has been brought up from the vaults, my inclination would be to run swatch against /var/log/auth.log (or your distro / syslog config's appropriate file), and configure it to respond with an email to each occurrence of sshd.*Accepted.*, since this should catch both password-based and key-based logins:

Feb 21 10:06:44 lory sshd[24414]: Accepted publickey for username from ::1 port 39197 ssh2
Feb 21 10:08:16 bill sshd[20643]: Accepted password for username from ::1 port 46835 ssh2

which you could do with a config file saying, e.g.,

watchfor /sshd.*Accepted.*/
               mail address=you@example.com,subject="SSH login on host foo"

and e.g. swatch -c /the/above/file /var/log/auth.

share|improve this answer
    
Very nice tool, thanks. –  Fedir Feb 21 '13 at 11:15

I recently developed my own solution for this problem, which involves monitoring log-files for different services (sshd included), and notifying a single e-mail when certain users gain access to certain services.

I call it Authentication Monitor and you can find more information about it here: http://bwyan.dk/?p=1744

I hope this could be what you are looking for.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.