# Email notification when user logs on via ssh

## F4lC0N

Ive searched and searched but cant find out how to get an email sent whenever some one logs on via ssh

so what i want is something that sends an email to say monitor@domain.com every time a user logs on.

can any one give me a few pointers or a solution ? im not a good programer so writing a script that goes threw the logs isnt an option.

----------

## echto

Quick and dirty.

tail -f /var/log/messages | grep sshd | grep opened | mail -s ssh your@emailaddr.com

 :Cool: 

----------

## Genone

I'd just hack something into /etc/profile.

----------

## F4lC0N

 *Genone wrote:*   

> I'd just hack something into /etc/profile.

 

i was thinking something like that but didnt know how to do it

can you give me a pointer or two ?

i can email from the cli just getting it to send an email when some one logs in is the problem

----------

## Genone

When you're logged in with ssh it sets a few environment variables (SSH_CONNECTION, SSH_CLIENT and a few more), just test for those in a if statement in /etc/profile:

```
if [ -n "$SSH_CONNECTION" ]; then

    # send mail

fi

```

I've used something similar for example to restrict ssh shell access to root, but still allow cvs+ssh access to users (and no, using only keys wasn't an option).Last edited by Genone on Tue Jun 28, 2005 8:20 am; edited 1 time in total

----------

## F4lC0N

that sounds pretty good  :Smile: 

I take it theres an enviroment variable that i can insert into the email to say what the user name is ?

----------

## echto

 *Genone wrote:*   

> Why you're logged in with ssh it sets a few environment variables (SSH_CONNECTION, SSH_CLIENT and a few more), just test for those in a if statement in /etc/profile:
> 
> ```
> if [ -n "$SSH_CONNECTION" ]; then
> 
> ...

 

Good one!  :Very Happy: 

I keep forgetting about /etc/profile.

I think I'll go walk into a fish market and yell "QUICK! Someone slap me with a wet trout!"

 :Cool: 

----------

## F4lC0N

Thanks heres what ive got

if [ -n "$SSH_CONNECTION" ]; then

    echo "WARNING: user $USER has loged on " |mail -s"WARNING: user $USER has loged on " user@domain.com

fi

works like a charm

sends and email with the users name in when the ssh in and doesnt send one if the sftp in

Thanks for your help

----------

## mach.82

I don't have the mail command in my Gentoo system as I am using postfix!

Also, I don't think ssmtp and postfix can co-exist in the same system.

Q: What else can I use instead of the mail command with Postfix?

Thanks.

----------

## zOOz

 *mach.82 wrote:*   

> I don't have the mail command in my Gentoo system as I am using postfix!
> 
> Also, I don't think ssmtp and postfix can co-exist in the same system.
> 
> Q: What else can I use instead of the mail command with Postfix?
> ...

 

You can use mail-client/nail it is very nice and configurable.

----------

