1

I'm trying to let my server send me automatically an email on ssh-login.

What I've done:

  1. Created a login-notify.sh file (user root, group root, chmod 755) and placed it inside /etc/ssh/

    #!/bin/sh 
    if [ "$PAM_TYPE" != "close_session" ]; then
        # assembling my variable $TEXT ...
    echo $TEXT | mail -r "root@.... " - s "Subject line" root
    
  2. Modified /etc/pam.d/sshd:

    echo "session required pam_exec.so seteuid /etc/ssh/login-notify.sh" | sudo tee -a /etc/pam.d/sshd
    
  3. restarted sshd server and even rebooted the machine

  4. Manually fired up /etc/ssh/login-notify.sh -> mail successful sent

  5. Logged in through ssh -> no mail has been sent

Addition steps / Information

  1. for sending emails from command line I use ssmtp and a gmail-account

  2. instead of sending a mail I've tried to append a string to a file and see if it works (echo "ssh login > /home/user/ssh-test) -> no luck...

  3. server only accepts public/key authentication for ssh-logins

  4. /var/log/syslog provides no useful information:

    Dec 27 14:20:51 srv1 fwknopd[2155]: Removed rule 1 from FWKNOP_INPUT with expire time of 1419686451 
    Dec 27 14:41:48 srv1 fwknopd[2155]: (stanza #1) SPA Packet from IP: xxx.xxx.xxx.xxx received with Access source match 
    Dec 27 14:41:48 srv1 fwknopd[2155]: [xxx.xxx.xxx.xxx] (stanza #1) Incoming SPA data signed by 'XXXXXX'. 
    Dec 27 14:41:48 srv1 fwknopd[2155]: Added Rule to FWKNOP_INPUT for xxx.xxx.xxx.xxx, tcp/xxx expires at 1419687738
    

    After this line I logged in through ssh... no additional text was written to /var/log/syslog

  • If all your users use bash you might as well do this from the profile script or bashrc. I've done this in the past and it worked. Don't know about PAM. – Marki Dec 27 '14 at 13:56
  • @janos - Yes. I've put two "echo "test1/2 > /home/user/ssh-test" -lines side my .sh. One outside the "if [$PAM_TYPE..." and one inside. – vigri Dec 27 '14 at 14:09
  • @janos Yes, you are right. – vigri Dec 27 '14 at 14:48
  • There is a fairly developed answer here: askubuntu.com/a/729841/723997 – Craig Hicks Jul 15 '18 at 8:28
1

hm, install csf firewall or OSSEC, with built in functionality you need... according to your question subject line.

CSF Firewall:

lfd on cluster-master-acl: SSH login alert for user root from 86.234.45.45 (IE/Ireland/cm-86.234.45.045.ntlworld.ie)

Time:    Fri Dec 26 13:59:51 2014 +0000
IP:      86.234.45.45 (IE/Ireland/cm-86.234.45.045.ntlworld.ie)
Account: root
Method:  publickey authentication 

.

lfd on web1: SU login alert - Successful login from admin(uid=0) to root
Time:    Sat Dec 27 11:45:26 2014 -0500
From:    admin(uid=0)
To:      root
Status:  Successful login

OSSEC:

OSSEC HIDS Notification.
2014 Dec 28 10:58:53

Received From: (web-node-3) 138.71.183.65->/var/log/secure
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Dec 28 05:58:49 ID13412 sudo: pam_unix(sudo:auth): conversation failed

and so on in fact you can modify alerts like you need them.

http://configserver.com/cp/csf.html
http://www.ossec.net/

1

Don't make it too complicated. You can just setup fail2ban with a mail-only action to notify you on failed attempts.

  • 1
    A pam-exec solution is way simpler than fail2ban. – user186340 Dec 28 '14 at 13:32
  • The point is: fail2ban is installing, changing like one line in the config. pam-exec might be more lightweight, but it is not easier and not easier to maintain. So its better to have the ready-to-use (and install-and-forget) solution instead of writing own scripts. – allo Dec 29 '14 at 14:24
  • Good point. There is a good pam based answer here, but it misses the last log line. So fail2ban may be the best answer. – Craig Hicks Jul 15 '18 at 8:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.