0

Looked through other questions about email alerts on login but have 2 questions:

Can the alert be triggered by users connecting via SFTP as well? (I tried this before and it only triggered an email when using SSH and not using SFTP for remotely transferring)

The other answers said that an email alert wont work when the -n switch is used via SSH, is there a way around this?

Thanks.

0

Basically, I would use something in .bashrc to trigger the mail sending command. With includes and permissions tricks, you could make it impossible to edit for the user (give .bashrc to root, make it include .bashrc_priv, which you give to the user for his own configuration).

.bashrc, belongs to root

# trigger mail here
[ -f "~/.bashrc_priv" ] && . ~/.bashrc_priv

.bashrc_priv, belongs to $USER

# Whatever you want in your users' bashrc ; they can edit this file.

As I recall, SFTP triggers the bash login process.

If you're using something in particular to trigger the alert (some package/application), let me know.

0

You can set this up with rsyslog, which you are probably running. It includes an output module to send an email, and you can set up a rule to email a certain address when a logged message is matched. Here's an example:

$ModLoad ommail
$ActionMailSMTPServer mail.example.net
$ActionMailFrom example@example.net
$ActionMailTo example@example.net
$template mailSubject,"User logged into %hostname%"
$template mailBody,"RSYSLOG Alert\r\nmsg='%msg%'"
$ActionMailSubject mailSubject
$ActionExecOnlyOnceEveryInterval 60
if $msg contains 'session opened for user' then :ommail:;mailBody

You can drop that in /etc/rsyslog.d/notify.conf, customize it as necessary, then run service rsyslog restart. You should receive emails that look like:

Date: Mon, 15 Jul 2013  2:30:01 UT
From: <example@example.net>
To: <example@example.net>
Subject: User logged into localhost
X-Mailer: rsyslog-immail

RSYSLOG Alert
msg=' pam_unix(cron:session): session opened for user root by (uid=0)'

You can read more about this functionality at: http://www.rsyslog.com/doc/ommail.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.