Receive notification by email when someone accesses as root by SSH

Those of us who administer servers must keep the strictest possible control over everything that happens on the server, one of the things that we often need to know is when a user connects via SSH (root included), for this with a package and a line would reach our email notifications.

Can you imagine that every time someone connects via SSH with root they get an email that says?

In other words, they would receive an email that would say something like this:

[miserver] Alert: Root Terminal access on: 2014/01/21 (200.55.51.151)

That is:

[$ NOMBRE_VPS] Alert: Access to Root Terminal on: $ DATE ($ IP_DE_WHO_S_CONNECT)

To achieve this they must first install a package called mailx.

Assuming your server uses Debian or some distro based on it (I recommend only Debian, not Ubuntu or similar for servers) it would be:

apt-get install mailx

Then we must put the following line in the root .bashrc:

echo 'ALERTA - Acceso a Terminal de Root en:' `hostname` 'el:' `date +'%Y/%m/%d'` `who | grep -v localhost` | mail -s "[ `hostname` ] Alerta: Acceso a Terminal de Root el: `date +'%Y/%m/%d'` `who | grep -v localhost | awk {'print $5'}`" mi@email.com

To edit /root/.bashrc use some editor in terminal like nano:

nano /root/.bashrc

After putting (anywhere in the file) the line that I put before, we save the file with Ctrl + O (Or bear) and we left it with Ctrl + X

Ready, every time someone enters the root terminal the .bashrc file will be loaded, which is something that is always done by default, and when the file is loaded, the line that sends the email will be executed, leaving something in our inbox as:

The explanation of the line is something really simple:

1. Through mailx I send the mail, with the parameter -s «_____» I specify the subject, and I pass it with echo «____» and a pipe the content of the body.
2. `hostname` with this I get the hostname or hostname, that is, the name of the VPS.
3. `date + '% Y /% m /% d'` the date command shows me the system date, the rest of the letters simply indicate how I want the date to be displayed.
4. who | grep -v localhost` If you run who on your computer it will show you the active users, with a grep -v localhost I make sure that it only shows those that have connected from a different location to the server itself, that is, basically SSH
5. `who | grep -v localhost | awk {'print $ 5'} `What differentiates this line from the previous one is the awk, through the awk and the printing of the 5th column is that I get the IP from where they connected to SSH

Anyway, the line is somewhat long and may seem complex to understand, however there are many strange characters but everything is quite simple 🙂

As always, I hope you have found it of interest.

regards