Send mail on login for a host
up vote
0
down vote
favorite
Is there any way to send a custom e-mail to custom recipients if any user tries to login or login to my system (RHEL6.7) ??
linux shell scripting rhel email
edited Nov 24 at 20:00
Rui F Ribeiro
38.3k1475126
asked Sep 12 '17 at 14:00
Rebbeca
276
add a comment |
up vote
0
down vote
favorite
Is there any way to send a custom e-mail to custom recipients if any user tries to login or login to my system (RHEL6.7) ??
linux shell scripting rhel email
edited Nov 24 at 20:00
Rui F Ribeiro
38.3k1475126
asked Sep 12 '17 at 14:00
Rebbeca
276
fail2ban is a brute force detection systems and can be configured to send emails on failed login attempts.
– Raman Sailopal
Sep 12 '17 at 14:11
@RamanSailopal She would also like to have an email sent on successful login attempts, it seems.
– Kusalananda
Sep 12 '17 at 14:12
If a slight delay/digest mode is OK, thenlogwatchmay do what you want - simply monitor the auth.log
– ivanivan
Sep 12 '17 at 14:54
@ivanivan little delay is Ok thanks for the response but how to use logwatch is it a package? how to setup the same? also at the same time setting this up will have any effect on the System space? just asking as it will generate logs too i guess
– Rebbeca
Sep 12 '17 at 15:08
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
Is there any way to send a custom e-mail to custom recipients if any user tries to login or login to my system (RHEL6.7) ??
linux shell scripting rhel email
edited Nov 24 at 20:00
Rui F Ribeiro
38.3k1475126
asked Sep 12 '17 at 14:00
Rebbeca
276
Is there any way to send a custom e-mail to custom recipients if any user tries to login or login to my system (RHEL6.7) ??
linux shell scripting rhel email
linux shell scripting rhel email
edited Nov 24 at 20:00
Rui F Ribeiro
38.3k1475126
asked Sep 12 '17 at 14:00
Rebbeca
276
edited Nov 24 at 20:00
Rui F Ribeiro
38.3k1475126
asked Sep 12 '17 at 14:00
Rebbeca
276
edited Nov 24 at 20:00
Rui F Ribeiro
38.3k1475126
edited Nov 24 at 20:00
Rui F Ribeiro
38.3k1475126
edited Nov 24 at 20:00
Rui F Ribeiro
38.3k1475126
38.3k1475126
asked Sep 12 '17 at 14:00
Rebbeca
276
asked Sep 12 '17 at 14:00
Rebbeca
276
asked Sep 12 '17 at 14:00
Rebbeca
276
276
fail2ban is a brute force detection systems and can be configured to send emails on failed login attempts.
– Raman Sailopal
Sep 12 '17 at 14:11
@RamanSailopal She would also like to have an email sent on successful login attempts, it seems.
– Kusalananda
Sep 12 '17 at 14:12
If a slight delay/digest mode is OK, thenlogwatchmay do what you want - simply monitor the auth.log
– ivanivan
Sep 12 '17 at 14:54
@ivanivan little delay is Ok thanks for the response but how to use logwatch is it a package? how to setup the same? also at the same time setting this up will have any effect on the System space? just asking as it will generate logs too i guess
– Rebbeca
Sep 12 '17 at 15:08
add a comment |
fail2ban is a brute force detection systems and can be configured to send emails on failed login attempts.
– Raman Sailopal
Sep 12 '17 at 14:11
@RamanSailopal She would also like to have an email sent on successful login attempts, it seems.
– Kusalananda
Sep 12 '17 at 14:12
If a slight delay/digest mode is OK, thenlogwatchmay do what you want - simply monitor the auth.log
– ivanivan
Sep 12 '17 at 14:54
@ivanivan little delay is Ok thanks for the response but how to use logwatch is it a package? how to setup the same? also at the same time setting this up will have any effect on the System space? just asking as it will generate logs too i guess
– Rebbeca
Sep 12 '17 at 15:08
fail2ban is a brute force detection systems and can be configured to send emails on failed login attempts.
– Raman Sailopal
Sep 12 '17 at 14:11
fail2ban is a brute force detection systems and can be configured to send emails on failed login attempts.
– Raman Sailopal
Sep 12 '17 at 14:11
@RamanSailopal She would also like to have an email sent on successful login attempts, it seems.
– Kusalananda
Sep 12 '17 at 14:12
@RamanSailopal She would also like to have an email sent on successful login attempts, it seems.
– Kusalananda
Sep 12 '17 at 14:12
If a slight delay/digest mode is OK, then
logwatch may do what you want - simply monitor the auth.log– ivanivan
Sep 12 '17 at 14:54
If a slight delay/digest mode is OK, then
logwatch may do what you want - simply monitor the auth.log– ivanivan
Sep 12 '17 at 14:54
@ivanivan little delay is Ok thanks for the response but how to use logwatch is it a package? how to setup the same? also at the same time setting this up will have any effect on the System space? just asking as it will generate logs too i guess
– Rebbeca
Sep 12 '17 at 15:08
@ivanivan little delay is Ok thanks for the response but how to use logwatch is it a package? how to setup the same? also at the same time setting this up will have any effect on the System space? just asking as it will generate logs too i guess
– Rebbeca
Sep 12 '17 at 15:08
add a comment |
1 Answer
1
active
oldest
votes
up vote
1
down vote
accepted
There are multiple ways to achieve what you are looking for. I will list out two ways to do it.
logwatch, a log-monitoring system that can send emails reporting any ssh activity.
sudo yum install logwatch
sudo cp /usr/share/logwatch/default.conf/logwatch.conf /etc/logwatch/conf/logwatch.conf
sudo logwatch --service sshd --range today --mailto <custom email IDs of recipients comma separated> --detail low
A custom shell script in the
/etc/profile.dfolder. Normally, this script will be executed each time any user logs in the system.
You may copy the following script into /etc/profile.d/name_of_the_alerts_file.sh file. It will send an email with the text produced by the
echo. Thewhoamiwill be replaced by the current user and thehostnameby the server's name.
#!/bin/bash
echo -e "
########################################################
# This is an alert you requested for
# User `whoami` logged into `hostname` at `date`
#
#
########################################################
" | mailx -r login-alerts -s "Login-Alert on `hostname`" <recipient 1>,<recipient 2>
The second method is useful if you want to customize the message being sent in the emails.
edited Sep 18 '17 at 5:08
Jaime
25115
answered Sep 18 '17 at 2:15
Pradeep Ravilla
362
There is Linux-Mag article describing how to uselogwatch. It includes an example using it to monitor sshd activity.
– Jaime
Sep 18 '17 at 5:09
@Pradeep Ravilla - Super usefull :-) heads up for the detailed solution
– Rebbeca
Sep 18 '17 at 14:13
add a comment |
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
1
down vote
accepted
There are multiple ways to achieve what you are looking for. I will list out two ways to do it.
logwatch, a log-monitoring system that can send emails reporting any ssh activity.
sudo yum install logwatch
sudo cp /usr/share/logwatch/default.conf/logwatch.conf /etc/logwatch/conf/logwatch.conf
sudo logwatch --service sshd --range today --mailto <custom email IDs of recipients comma separated> --detail low
A custom shell script in the
/etc/profile.dfolder. Normally, this script will be executed each time any user logs in the system.
You may copy the following script into /etc/profile.d/name_of_the_alerts_file.sh file. It will send an email with the text produced by the
echo. Thewhoamiwill be replaced by the current user and thehostnameby the server's name.
#!/bin/bash
echo -e "
########################################################
# This is an alert you requested for
# User `whoami` logged into `hostname` at `date`
#
#
########################################################
" | mailx -r login-alerts -s "Login-Alert on `hostname`" <recipient 1>,<recipient 2>
The second method is useful if you want to customize the message being sent in the emails.
edited Sep 18 '17 at 5:08
Jaime
25115
answered Sep 18 '17 at 2:15
Pradeep Ravilla
362
There is Linux-Mag article describing how to uselogwatch. It includes an example using it to monitor sshd activity.
– Jaime
Sep 18 '17 at 5:09
@Pradeep Ravilla - Super usefull :-) heads up for the detailed solution
– Rebbeca
Sep 18 '17 at 14:13
add a comment |
up vote
1
down vote
accepted
There are multiple ways to achieve what you are looking for. I will list out two ways to do it.
logwatch, a log-monitoring system that can send emails reporting any ssh activity.
sudo yum install logwatch
sudo cp /usr/share/logwatch/default.conf/logwatch.conf /etc/logwatch/conf/logwatch.conf
sudo logwatch --service sshd --range today --mailto <custom email IDs of recipients comma separated> --detail low
A custom shell script in the
/etc/profile.dfolder. Normally, this script will be executed each time any user logs in the system.
You may copy the following script into /etc/profile.d/name_of_the_alerts_file.sh file. It will send an email with the text produced by the
echo. Thewhoamiwill be replaced by the current user and thehostnameby the server's name.
#!/bin/bash
echo -e "
########################################################
# This is an alert you requested for
# User `whoami` logged into `hostname` at `date`
#
#
########################################################
" | mailx -r login-alerts -s "Login-Alert on `hostname`" <recipient 1>,<recipient 2>
The second method is useful if you want to customize the message being sent in the emails.
edited Sep 18 '17 at 5:08
Jaime
25115
answered Sep 18 '17 at 2:15
Pradeep Ravilla
362
There is Linux-Mag article describing how to uselogwatch. It includes an example using it to monitor sshd activity.
– Jaime
Sep 18 '17 at 5:09
@Pradeep Ravilla - Super usefull :-) heads up for the detailed solution
– Rebbeca
Sep 18 '17 at 14:13
add a comment |
up vote
1
down vote
accepted
up vote
1
down vote
accepted
There are multiple ways to achieve what you are looking for. I will list out two ways to do it.
logwatch, a log-monitoring system that can send emails reporting any ssh activity.
sudo yum install logwatch
sudo cp /usr/share/logwatch/default.conf/logwatch.conf /etc/logwatch/conf/logwatch.conf
sudo logwatch --service sshd --range today --mailto <custom email IDs of recipients comma separated> --detail low
A custom shell script in the
/etc/profile.dfolder. Normally, this script will be executed each time any user logs in the system.
You may copy the following script into /etc/profile.d/name_of_the_alerts_file.sh file. It will send an email with the text produced by the
echo. Thewhoamiwill be replaced by the current user and thehostnameby the server's name.
#!/bin/bash
echo -e "
########################################################
# This is an alert you requested for
# User `whoami` logged into `hostname` at `date`
#
#
########################################################
" | mailx -r login-alerts -s "Login-Alert on `hostname`" <recipient 1>,<recipient 2>
The second method is useful if you want to customize the message being sent in the emails.
edited Sep 18 '17 at 5:08
Jaime
25115
answered Sep 18 '17 at 2:15
Pradeep Ravilla
362
There are multiple ways to achieve what you are looking for. I will list out two ways to do it.
logwatch, a log-monitoring system that can send emails reporting any ssh activity.
sudo yum install logwatch
sudo cp /usr/share/logwatch/default.conf/logwatch.conf /etc/logwatch/conf/logwatch.conf
sudo logwatch --service sshd --range today --mailto <custom email IDs of recipients comma separated> --detail low
A custom shell script in the
/etc/profile.dfolder. Normally, this script will be executed each time any user logs in the system.
You may copy the following script into /etc/profile.d/name_of_the_alerts_file.sh file. It will send an email with the text produced by the
echo. Thewhoamiwill be replaced by the current user and thehostnameby the server's name.
#!/bin/bash
echo -e "
########################################################
# This is an alert you requested for
# User `whoami` logged into `hostname` at `date`
#
#
########################################################
" | mailx -r login-alerts -s "Login-Alert on `hostname`" <recipient 1>,<recipient 2>
The second method is useful if you want to customize the message being sent in the emails.
edited Sep 18 '17 at 5:08
Jaime
25115
answered Sep 18 '17 at 2:15
Pradeep Ravilla
362
edited Sep 18 '17 at 5:08
Jaime
25115
edited Sep 18 '17 at 5:08
Jaime
25115
edited Sep 18 '17 at 5:08
Jaime
25115
25115
answered Sep 18 '17 at 2:15
Pradeep Ravilla
362
answered Sep 18 '17 at 2:15
Pradeep Ravilla
362
answered Sep 18 '17 at 2:15
Pradeep Ravilla
362
362
There is Linux-Mag article describing how to uselogwatch. It includes an example using it to monitor sshd activity.
– Jaime
Sep 18 '17 at 5:09
@Pradeep Ravilla - Super usefull :-) heads up for the detailed solution
– Rebbeca
Sep 18 '17 at 14:13
add a comment |
There is Linux-Mag article describing how to uselogwatch. It includes an example using it to monitor sshd activity.
– Jaime
Sep 18 '17 at 5:09
@Pradeep Ravilla - Super usefull :-) heads up for the detailed solution
– Rebbeca
Sep 18 '17 at 14:13
There is Linux-Mag article describing how to use
logwatch. It includes an example using it to monitor sshd activity.– Jaime
Sep 18 '17 at 5:09
There is Linux-Mag article describing how to use
logwatch. It includes an example using it to monitor sshd activity.– Jaime
Sep 18 '17 at 5:09
@Pradeep Ravilla - Super usefull :-) heads up for the detailed solution
– Rebbeca
Sep 18 '17 at 14:13
@Pradeep Ravilla - Super usefull :-) heads up for the detailed solution
– Rebbeca
Sep 18 '17 at 14:13
add a comment |
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f391811%2fsend-mail-on-login-for-a-host%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
fail2ban is a brute force detection systems and can be configured to send emails on failed login attempts.
– Raman Sailopal
Sep 12 '17 at 14:11
@RamanSailopal She would also like to have an email sent on successful login attempts, it seems.
– Kusalananda
Sep 12 '17 at 14:12
If a slight delay/digest mode is OK, then
logwatchmay do what you want - simply monitor the auth.log– ivanivan
Sep 12 '17 at 14:54
@ivanivan little delay is Ok thanks for the response but how to use logwatch is it a package? how to setup the same? also at the same time setting this up will have any effect on the System space? just asking as it will generate logs too i guess
– Rebbeca
Sep 12 '17 at 15:08