Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does anyone have a bash script that will email or notify someone in the case of a successful login to a ssh server? I want to be notified if anyone logs into my personal box.

I'm using Ubuntu 12.04 running xfce

share|improve this question
up vote 28 down vote accepted

Warning: according to the comments, this does not work if the user creates a file called ~/.ssh/rc.

Modify or create /etc/ssh/sshrc with the following contents:

ip=`echo $SSH_CONNECTION | cut -d " " -f 1`

logger -t ssh-wrapper $USER login from $ip
echo "User $USER just logged in from $ip" | sendemail -q -u "SSH Login" -f "Originator <>" -t "Your Name <>" -s &

This will effectively notify you by email anytime someone logs in through SSH, and the login will be logged in the syslog.

Note: You'll need the sendemailpackage (sudo apt-get install sendemail) for the email notification to work.

Note: works with port forwarding, but with -N option not.

share|improve this answer
Does this also work if the client doesn't request a TTY? E.g. ssh -N with only port forwarding. – gertvdijk Jan 5 '13 at 15:58
does this also work when we are using gmail as the smtp server ? – user155073 May 3 '13 at 6:38
This needs a Warning: This does not work if the user creates a file called ~/.ssh/rc so it's quite useless as a security measure. @adosaiguas' answer concerning pam_exec is the correct one. – Fritz Apr 16 '14 at 11:38

Warning: As always when you change the login configuration, leave a backup ssh session open in the background and test the login from a new terminal.

Since the sshrc method doesn't work if the user has their own ~/.ssh/rc file, I'll explain how to do this with pam_exec as @adosaiguas suggested. The good thing is that this can also be easily adapted to login types other than ssh (such as local logins or even all logins) by hooking into a different file in /etc/pam.d/.

First you need to be able to send mail from the command line. There are other questions about this. On a mail server it's probably easiest to install mailx (which is probably already installed anyway).

Then you need an executable script file (I put it in /etc/ssh/ for example) with the following content. You can change the variables to change the subject and content of the e-mail notification. Don't forget to execute chmod +x to make it executable.


# Change these two lines:

if [ "$PAM_TYPE" != "close_session" ]; then
    subject="SSH Login: $PAM_USER from $PAM_RHOST on $host"
    # Message to send, e.g. the current environment variables.
    echo "$message" | mailx -r "$sender" -s "$subject" "$recepient"

Once you have that, you can add the following line to /etc/pam.d/sshd:

session optional seteuid /path/to/

For testing purposes, the module is included as optional, so that you can still log in if the execution fails. After you made sure that it works, you can change optional to required. Then login won't be possible unless the execution of your hook script is successful (if that is what you want).

For those of you in need of an explanation of what PAM is and how it works, here is a very good one.

share|improve this answer
It says: /etc/ssh/ failed: exit code 13 right after login :( – FelikZ Aug 29 '14 at 13:43
Did you make the script executable by running chmod +x /etc/ssh/ Also, can you send mail manually using the mailx command used in the script? – Fritz Aug 29 '14 at 14:14
thank you, chmod does the trick. Btw I am using sendmail and it works fine too. – FelikZ Aug 30 '14 at 12:05
Thanks, it works great. Just make sure you have UsePAM set to yes in your sshd_config. – Nicolas BADIA Mar 11 '15 at 8:11
You should probably remove the fork (&) if you have required in the sshd file because mailx can fail but the user may still have logged on. Also, the script is run as root, so make sure mailx is also configured for root – texasflood Oct 4 '15 at 13:55

We have been using monit to monitor processes on our linux boxes. monit can also alert by emails on successful logins over ssh. Our monit config looks like this

 check file ssh_logins with path /var/log/auth.log  
     # Ignore login's from whitelist ip addresses
     ignore match ""    
     # Else, alert
     if match "Accepted publickey" then alert

Note: The mailserver configuration, email format etc. should be set in monitrc file

Update: Wrote a more detailed blog post on this

share|improve this answer

In this other question you probably have what you are looking for. Basically you can add a call to the mail command in the script that is run when a user logs in via ssh: /etc/pam.d/sshd

share|improve this answer

Put the following in /etc/profile:

if [ -n "$SSH_CLIENT" ]; then 
    TEXT="$(date): ssh login to ${USER}@$(hostname -f)" 
    TEXT="$TEXT from $(echo $SSH_CLIENT|awk '{print $1}')" 
    echo $TEXT|mail -s "ssh login" you@your.domain 

How the script works

/etc/profile is executed at every login (for bash shell users). The if statement will only return true if the user has logged in via ssh, which in turn will cause the indented code block to be run.

Next, we then build the text of the message:

  • $(date) will be replaced by the output of the date command
  • ${USER} will be replaced by the user’s login name
  • $(hostname -f) will be replaced by the full hostname of the system being logged into

The second TEXT line adds to the first, giving the IP address of the system this user is logging in from. Finally, the generated text is sent in an email to your address.

Summary Linux will, by default, record every system login, whether by ssh or not, in the system log files, but sometimes – particularly for a system that is seldom accessed via ssh – a quick and dirty notification can be useful.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.