Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My CentOS/RHEL system may have been hacked, I'm not sure. But I'm playing it safe by creating a new slice from scratch.

I've installed tripwire, but I'd also like to be emailed when anyone logs in. I don't want to wait for the daily logwatch report, I want an immediate email when anyone logs in. Preferably with their ip address too.


Similar to but maybe someone has a technique for this specific issue.



Added: has some ideas

share|improve this question
Please nuke it from orbit. – Jacob Feb 29 '12 at 0:10
up vote 6 down vote accepted

You should use a solucion for log monitoring like OSSEC, it will look on your logs for security information (including login, sudo, etc.) and send you an e-mail when the alert is important.

It's easy to configure and you can raise the alert level for e-mails or include an alert-by-email on the specific alert.

It can also do configurable active-response, blocking IPs and denying access for a period of time by default.

share|improve this answer

you could put in your .bashrc

echo 'ALERT - Root Shell Access (YOURSERVERNAME) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d"(" -f2 | cut -d")" -f1`" YOUREMAIL
share|improve this answer

You can add the appropriate command to, or call a script from, /etc/profile.

share|improve this answer

Be aware though that if your machine has been hacked it may be a trivial task for the hacker - assuming it's not a script kiddie we're talking about there - to disable the email alerting function.

share|improve this answer
Yes, that's why I want an email sent as soon as anyone logs in. -- The server doesn't get that many logins. I figure that way it will lower the odds of someone being able to prevent the email going out about their initial breakin (if via a login shell). – LarryK Aug 6 '09 at 20:39

This article describes how to Send email on SSH login using PAM.

share|improve this answer
While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. - From Review – kasperd Jul 19 at 13:41

Slight change of adams solution which doesn't break if root is logged into more than one terminals:

login_info="$(who | head -n1 | cut -d'(' -f2 | cut -d')' -f1)"
printf "ALERT - Root Shell Access (%s) on:\n" "$(hostname)"
mail -s "Alert: Root Access from ${login_info}" admin <<< "${message}"
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.