Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Few weeks ago I thought it would be a good idea to write a script which should send me an email whenever some user would log in into my server.

So I came to a perfectly working script notifyLogin.sh, then I decided to call it from each user's .bash_login script.

So long so good but today I discovered that someone could log in in my server using ssh client -t option selecting thus an available shell. For example:

ssh user@myserver -t sh

This way, .bash_login do not execute, neither /etc/profile.

My question is: Is there any "universal" (that means that id does not matter which shell is being used) script that executes whenever a user log in?

share|improve this question
    
No, any global script that gets run is ran by the shell or process being started. Different shells (may) use different files. A better way to achieve what you are trying to do would be to configure your system so that logins are logged to your log files. You then act on those log entries by having a script or program monitor those files and either alerting or running another script/program when those log entries are found. –  yoonix Jul 10 at 19:19
    
@yoonix This logins are already being registered and I can check them using last tool, am I wrong? –  Pablo Francisco Pérez Hidalgo Jul 10 at 19:23
    
You're not wrong, but you running last and looking for new entries repeatedly does not equate to 'sending an email when a user logs in.' It can work but it's far less efficient IMO. Instead of running one script that continuously watches you're going to run that command repeatedly even if nobody new has logged in. –  yoonix Jul 10 at 19:27

3 Answers 3

up vote 3 down vote accepted

One way to do this is to use syslog and redirect the message to email:

Another way is to use a log parser like SEC or Splunk.

share|improve this answer

Another option is to use pam. Stolen from page found in google:

session optional pam_exec.so /path/to/your/script/or/executable

For details see pam_exec(8) man page. The advantage is that you don't need to parse the logs to do it - it uses standard mechanism for plugging-in sessions. Depending on where you put it you can use it to send whenever user creates a new session or only when it connects via SSH.

share|improve this answer

an alternative: you may run a filtering of secure log in a background to extract interesting events, like:

tail -n 0 -f /var/log/secure | grep --line-buffered "sshd:session): session opened" > /var/log/sec-filtered

and have a periodic task that checks for size of filtered output file to send it be e-mail and restart filtering on secure log.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.