Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to be notified by email when my Ubuntu server is accessed via SSH.

If it is possible, how can I do it?

share|improve this question
Possible duplicate:… – belacqua Aug 1 '14 at 21:32

pam_script will run any program you want when a user logs in.

share|improve this answer
Just a note: if you're still on Lucid you'll have to compile pam_script yourself (it was included with Oneiric) – Joril Apr 17 '13 at 7:09

You should be able to do so with a rule in /etc/hosts.allow. Try something like:

sshd: ALL: (/usr/bin/echo "SSH connection from %h (%H)" | /usr/bin/mailx -s "SSH Alert" 

You can get more detail from a script run from /etc/profile.d, or included in /etc/profile. However, this will only work if the user logs in to an interactive session.

If you don't need immediate notification, the logcheck program can notify you hourly of any accesses in the last hour. You will need to add appropriate rules to the configuration.

EDIT: Ubuntu uses the incompatible hosts_options format to execute shell commands. The follow rule is what I implemented:

SSHD: ALL: spawn (/bin/echo "SSH connection to %H from %h[%a]" | \
     /usr/bin/mailx -s "SSH Alert"

Notes: Backslash notation can be used to wrap lines as above. Substitution characters are documented in the hosts.allow man page.

share|improve this answer
I'm getting ssh_exchange_identification: Connection closed by remote host error after setting this. Commenting it out in /etc/hosts.allow makes it work again. – MHK Aug 8 '12 at 20:52
@MHK What happens if you run the commands in brackets at the command line? – BillThor Aug 8 '12 at 22:57
That sends a mail, I had to change /usr/bin/echo to /bin/echo though on my system. I've disabled root login and password based login via ssh, changed port, watching it with Fail2ban. Other than that, it's a typical Ubuntu 12.04 server edition. – MHK Aug 9 '12 at 9:11
You will need to change your command in /etc/hosts.allow accordingly. – BillThor Aug 9 '12 at 14:14
I did that before posting the error message here. – MHK Aug 10 '12 at 17:55

Your best bet is to set up a script to watch the log file.

I'm on my phone at the moment, but Check /var/log/access.log

share|improve this answer
I'm using swatch – Joril Apr 17 '13 at 7:10
would you care to complete your answer now that you have probably had access to your desktop environment? – tony gil Jun 1 '14 at 14:37

The log is on auth.log, you can do a

cat /var/log/auth.log | grep ssh

To actualy send the mail you could install SSMTP, edit it's config as follows:

/etc/ssmtp/ssmtp.conf AuthUser=yourusername AuthPass=yourpassword FromLineOverride=YES UseTLS=YES

Create a text file with the message body as follows:

To: From: Subject: SSH warning or whatever


To add the content you could do:

tail /var/log/auth.log | grep ssh >> /tmp/mailcontents.txt

and then run

ssmtp < /tmp/mailcontents.txt


Another OP said you might want a notification each time it happens, you coud do something LIKE this:

create an script with


tail /var/log/auth.log | grep ssh >> /tmp/alert&

while true; do
   change=$(inotifywait -e close_write,moved_to,create .)
   change=${change#./ * }
   if [ "$change" = "/tmp/alert" ]; then 
       tail -n 1 /tmp/alert >> /tmp/mailcontents.txt
       ssmtp < mailcontents.txt; 

Mailcontents should include the addresses as stated before, the script code has not been checked to be valid, consider it pseudocode.

share|improve this answer
I think the OP wants to be notified when events occur, not create a custom report once. – ℝaphink Jun 20 '12 at 22:53
well same principle, he'd just need to tail /var/log/auth.log permanently with the -f switch as in tail -f --follow=name /var/log/auth.log >> /tmp/alert.log, then he can use inotifywait to track changes in the alert file. – AndresSM Jun 21 '12 at 0:37
I failed to use ssmtp. It can connect to gmail server but said the authentication fails while using the same email & password I can log in. Do you have any idea why? The error is ssmtp: Authorization failed (535 5.7.1 nh8sm37308607pbc.60) – Nam G VU Jun 22 '12 at 1:40
Did you try this? – AndresSM Jun 22 '12 at 3:38
@Andres Yes I did. But still the authentication still fails – Nam G VU Jun 22 '12 at 4:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.