1

The problem I am having is that the action I am looking for is for sendemail to send myself an email that contains both w output from the ssh user and output from doing an lsof -u on $SSH_USER to see what open files they have.

Here is the script:

#!/usr/bin/env bash
# This line looks for the string "pts/" in the output of `w`, then strips out the owner information and passes it to SSH_USER

SSH_USER="$(w | grep "pts/" | cut -d" " -f1 | awk 'NR < 2')";
SSH_USERS="$(w)"

if w  | grep -q "pts/"; then
  echo "someone logged-in via ssh" && sendemail -f "xxx.notify@gmail.com" -u "someone has logged-in via ssh " -t "my.email@gmail.com" -s "smtp.gmail.com:587" -m "$SSH_USERS \n lsof -u "$SSH_USER"" -o tls=yes -xu "xxx.notify@gmail.com" -xp 'my_notify.email.pw'
else
  echo "nobody logged-in via ssh"
fi

Note that the -m option is where the body of the email goes, and I am filling it with two variables. One is the output of w and the other is the ouput of an lsof -u $SSH_USER, which in this case should expand out to lsof -u robert.

Here is the output of w:

23:46:23 up  3:41,  3 users,  load average: 0.40, 0.44, 0.50
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
robert   :0       :0               20:07   ?xdm?   6:10   0.01s /usr/lib/gdm3/gdm-x-session --run-script env GNOME_SHELL_SESSION_MODE=ubuntu gnome-se
robert   pts/1    10.0.0.3         22:56   50:04   0.04s  0.04s -bash
robert   pts/4    10.0.0.3         23:10   36:16   0.04s  0.04s -bash

Here is the email I am getting:

23:40:31 up  3:35,  3 users,  load average: 0.60, 0.60, 0.56
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
robert   :0       :0               20:07   ?xdm?   6:05   0.01s /usr/lib/gdm3/gdm-x-session --run-script env GNOME_SHELL_SESSION_MODE=ubuntu gnome-session --session=ubuntu
robert   pts/1    10.0.0.3         22:56   44:12   0.04s  0.04s -bash
robert   pts/4    10.0.0.3         23:10   30:24   0.04s  0.04s -bash 
 lsof -u robert

You can see at the bottom of the email it says lsof -u robert so it expands the variable correctly - but it just echos it, instead of displaying the output of the command.

There must be something I am doing wrong in the -m "$SSH_USERS \n lsof -u "$SSH_USER"" part of the script - what could be the reason that it's only sending me the output from the first half of the message? How to get that lsof -u $SSH_USER to actually run and provide output rather than just echo itself?

2

You need to use Bash command substitution in the same manner as you have done earlier in the script.

Change:

-m "$SSH_USERS \n lsof -u "$SSH_USER""

to

-m "$SSH_USERS \n $(lsof -u "$SSH_USER")"

This will actually run the lsof command that you're looking for.

It's also worth noting that double quotes do not nest, they act like a toggle, som in the original version, you quote "$SSH_USERS \n lsof -u " while $SSH_USER is unquoted, then the "" at the end doesn't do anything.

  • 1
    Actually, I screwed up - I was editing a commented out command (doh!). I edited the right command and now the only error I am getting is ssh-login: line 19: /usr/bin/sendemail: Argument list too long. So, I am guessing your command works - it's just expanding to such a message length with the lsof output that it's too long for the outgoing email. I will try to grep it down a bit and try again. – Robert Baker Dec 3 '18 at 20:43
  • 1
    Yes, that was it. I changed the command to -m "$SSH_USERS \n $(lsof -u "$SSH_USER" | grep bash)" and now I get the out put from w and the output of lsof -u robert | grep bash in the same email notification - thank you for your help! – Robert Baker Dec 3 '18 at 20:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.