msgbartop
A chronological documentation test project, nothing serious, really!
msgbarbottom

05 Feb 2014 One-liner to mail when someone logs in as root

This is a short post describing how to automatically send an email every time someone logs in as root on a linux server.
Add the following line to /root/.bash_profile if you are using bash as your default shell interpreter. Refer to /etc/passwd.

(echo "Subject: ALERT: servername Root Shell Access from `who | awk '{print $5}'`"; echo "ALERT - servername Root Shell Access on:' `date` `who`")| mail -s "root access on servername" user@example.com

This will send an email to user@example.com every time someone starts using the root shell.
Quite handy and can be a way to detect if your server has been compromised.

This has been tested on ubuntu 13.10 and requires that you have access to the mail command, available in the mailutils package.

Tags: , , ,

Posted by