topic Re: Email Sys Admin every login in Operating System - Linux

Email Sys Admin every login

Lisa Mauer — Fri, 17 Sep 2004 09:57:54 GMT

Is there a way in Linux to email me user and computer name (which shows up in the /var/log/messages file) anytime someone successfully logs in to the server? We have some Linux servers that don't really need to be logged into, the HP-UX server loads everything for them so I don't want anyone logging into them without notifying me. If they do I would like to know so I can ask what they are doing. This is a development org not production so they may need to login for different purposes but I just want to know.... I could write a script to run in cron and gather all the suyccessful logins every minute along with their computer name, but thought if there was a better way, you Linux gurus would know....

Re: Email Sys Admin every login

Rick Garland — Fri, 17 Sep 2004 10:01:43 GMT

The who -um command can provide the info you are looking for. Will have parse the output to get the specific info. You script could keep a pointer record and alert you if any new entries appear.

Re: Email Sys Admin every login

Rick Garland — Fri, 17 Sep 2004 10:10:02 GMT

Doing some experimenting (RH 3.0 ES) shows that the last will do it as well. Will provide their terminal, date/time of login, from where they are, etc.

Still some scripting is gong to be needed to parse the info.

Re: Email Sys Admin every login

John Poff — Fri, 17 Sep 2004 15:49:49 GMT

Hi,

What if you just put something like this somewhere in /etc/profile?

echo "User $USER just logged onto $HOSTNAME" | mail -s "Login notice" root

JP

Re: Email Sys Admin every login

Lisa Mauer — Fri, 17 Sep 2004 16:07:50 GMT

John - brilliant! Thanks for all the answers, but John's idea is what I needed :)

Re: Email Sys Admin every login

Ross Minkov — Sun, 19 Sep 2004 10:39:02 GMT

Lisa,

Just a quick note... Not all users run /etc/profile. For example if you have any csh or tcsh users (check /etc/passwd to see if you have any) they will run /etc/csh.login instead of /etc/profile.

Also not every access to the system is a login. For example:
rsh -l user host command
or
ssh -l user host command
will not be considered logins and would not go through /etc/profile

Regards,
Ross

Re: Email Sys Admin every login

Steven E. Protter — Sun, 19 Sep 2004 20:47:22 GMT

While this method id pretty slick:

echo "User $USER just logged onto $HOSTNAME" | mail -s "Login notice" root

You might want to actually route the email to an account that pops up on your screen. Perhaps your exchange account.

root gets an email in Linux every time a cron job is run if you are using the mail -s methodology.

Since its logins you are concerned with you might want to know immediately.

If you have no exchange server you can add an account for this purpose.

Since root gets so many emails it may be a good idea to segment this output.

I take it login volume is low and you're wondering why anyone would log in to the system. If login volume is high all you're doing is filling up the mailbox in the /var filesystem.

Do see that there is enough space in /var to accomodate the load.

SEP

Re: Email Sys Admin every login

Lisa Mauer — Mon, 20 Sep 2004 07:51:51 GMT

Thanks for the information, I never thought of ssh. I did change the root email to be my exchange email, figured since I don't even log in much I wouldn't see any logins.
Thanks again!

Re: Email Sys Admin every login

John Poff — Mon, 20 Sep 2004 08:37:11 GMT

Ross has an interesting point, but I got curious and decided to test it out. I setup my Linux box with the e-mail line in /etc/profile, and I connected using the 'rsh' and 'ssh' examples Ross gave. My box sent me e-mail messages for both attempts, so it looks like they do go through /etc/profile, which kind of makes sense if you are getting a shell prompt.

JP

Re: Email Sys Admin every login

John Poff — Mon, 20 Sep 2004 08:41:53 GMT

Oops. I shouldn't post on Monday morning before I've had my coffee! :)

Ross is correct. His example just executes a command as a user, which does not execute the /etc/profile command. Those connections are logged in /var/log/messages. I was trying a straight login via rsh and ssh, which were getting a shell and running /etc/profile.

Sorry Ross. ;)

JP