How can I configure my server to notify me whenever it is remotely accessed via ssh?

Question

I need to be notified by email when my Ubuntu server is accessed via SSH.

If it is possible, how can I do it?

Answer 1

pam_script will run any program you want when a user logs in.

Answer 2

You should be able to do so with a rule in /etc/hosts.allow. Try something like:

sshd: ALL: (/usr/bin/echo "SSH connection from %h (%H)" | /usr/bin/mailx -s "SSH Alert" you@example.com) 

You can get more detail from a script run from /etc/profile.d, or included in /etc/profile. However, this will only work if the user logs in to an interactive session.

If you don't need immediate notification, the logcheck program can notify you hourly of any accesses in the last hour. You will need to add appropriate rules to the configuration.

EDIT: Ubuntu uses the incompatible hosts_options format to execute shell commands. The follow rule is what I implemented:

SSHD: ALL: spawn (/bin/echo "SSH connection to %H from %h[%a]" | \
     /usr/bin/mailx -s "SSH Alert" me@example.com)

Notes: Backslash notation can be used to wrap lines as above. Substitution characters are documented in the hosts.allow man page.

Answer 3

Your best bet is to set up a script to watch the log file.

I'm on my phone at the moment, but Check /var/log/access.log

Answer 4

The log is on auth.log, you can do a

cat /var/log/auth.log | grep ssh

To actualy send the mail you could install SSMTP, edit it's config as follows:

/etc/ssmtp/ssmtp.conf

root=yourusername@gmail.com mailhub=smtp.gmail.com:465 rewriteDomain=gmail.com AuthUser=yourusername AuthPass=yourpassword FromLineOverride=YES UseTLS=YES

Create a text file with the message body as follows:

To: recipient@gmail.com From: yourusername@gmail.com Subject: SSH warning or whatever

MAIL CONTENT

To add the content you could do:

tail /var/log/auth.log | grep ssh >> /tmp/mailcontents.txt

and then run

ssmtp recipient_name@gmail.com < /tmp/mailcontents.txt

---

EDIT:

Another OP said you might want a notification each time it happens, you coud do something LIKE this:

create an script with

!/bin/sh

tail /var/log/auth.log | grep ssh >> /tmp/alert&

while true; do
   change=$(inotifywait -e close_write,moved_to,create .)
   change=${change#./ * }
   if [ "$change" = "/tmp/alert" ]; then 
       tail -n 1 /tmp/alert >> /tmp/mailcontents.txt
       ssmtp recipient_name@gmail.com < mailcontents.txt; 
   fi
done

Mailcontents should include the addresses as stated before, the script code has not been checked to be valid, consider it pseudocode.