0

Is there a way to set up automatic email notification if your account at a Linux server is accessed from a new IP/ domain?

This would be useful if some hacker gained access to your account (clearly such access would be from an IP or a new domain unknown to you), and you got a notification by email immediately. If you happen to login from a new IP, you can ignore the email, but an email notification would be particularly useful if the login is more likely from a hacker.

Thank you.

Improve this question

1 Answer 1

Reset to default
1

The only way i have in mind is very simple but won't cover the a filter for a "new ip/domain". Simply install a lightweight mail client and edit the .bashrc file for every linux user with ssh access, .bashrc get's executed at the user's login, so simply put a simple mail command using your mail client there. Refer to this tutorial i have found for more info: http://www.tecmint.com/get-root-ssh-login-email-alerts-in-linux/

Improve this answer
2
  • thank you for the very useful info! yes if there is a way to block a whole domain, it would be more convenient than blocking a specific IP. (as for blocking IP, is there a way to make wildcards work, e.g., blocking 67*.*.*.* would block all IPs starting with 67?)
    – water stone
    Apr 7, 2014 at 1:14
  • Well, you could try to block a specific ip range via iptables. For example: iptables -A INPUT -m iprange --src-range 67.0.0.1-67.255.255.255 -j DROP
    – Pathin
    Apr 7, 2014 at 17:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .