Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My CentOS/RHEL system may have been hacked, I'm not sure. But I'm playing it safe by creating a new slice from scratch.

I've installed tripwire, but I'd also like to be emailed when anyone logs in. I don't want to wait for the daily logwatch report, I want an immediate email when anyone logs in. Preferably with their ip address too.

Suggestions?

Similar to http://serverfault.com/questions/34141/send-email-alert-on-log-file-entry but maybe someone has a technique for this specific issue.

Thanks,

Larry

Added: http://forums11.itrc.hp.com/service/forums/questionanswer.do?admit=109447626+1249534744623+28353475&threadId=698232 has some ideas

share|improve this question
    
Please nuke it from orbit. i.stack.imgur.com/cFSC5.png –  Jacob Feb 29 '12 at 0:10
add comment

5 Answers

up vote 5 down vote accepted

You should use a solucion for log monitoring like OSSEC, it will look on your logs for security information (including login, sudo, etc.) and send you an e-mail when the alert is important.

It's easy to configure and you can raise the alert level for e-mails or include an alert-by-email on the specific alert.

It can also do configurable active-response, blocking IPs and denying access for a period of time by default.

share|improve this answer
add comment

you could put in your .bashrc

echo 'ALERT - Root Shell Access (YOURSERVERNAME) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d"(" -f2 | cut -d")" -f1`" YOUREMAIL
share|improve this answer
add comment

This article describes how to Send email on SSH login using PAM.

share|improve this answer
add comment

Be aware though that if your machine has been hacked it may be a trivial task for the hacker - assuming it's not a script kiddie we're talking about there - to disable the email alerting function.

share|improve this answer
1  
Yes, that's why I want an email sent as soon as anyone logs in. -- The server doesn't get that many logins. I figure that way it will lower the odds of someone being able to prevent the email going out about their initial breakin (if via a login shell). –  LarryK Aug 6 '09 at 20:39
add comment

You can add the appropriate command to, or call a script from, /etc/profile.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.