0

Is there a way to set up automatic email notification if your account at a Linux server is accessed from a new IP/ domain?

This would be useful if some hacker gained access to your account (clearly such access would be from an IP or a new domain unknown to you), and you got a notification by email immediately. If you happen to login from a new IP, you can ignore the email, but an email notification would be particularly useful if the login is more likely from a hacker.

Thank you.

1

The only way i have in mind is very simple but won't cover the a filter for a "new ip/domain". Simply install a lightweight mail client and edit the .bashrc file for every linux user with ssh access, .bashrc get's executed at the user's login, so simply put a simple mail command using your mail client there. Refer to this tutorial i have found for more info: http://www.tecmint.com/get-root-ssh-login-email-alerts-in-linux/

  • thank you for the very useful info! yes if there is a way to block a whole domain, it would be more convenient than blocking a specific IP. (as for blocking IP, is there a way to make wildcards work, e.g., blocking 67*.*.*.* would block all IPs starting with 67?) – water stone Apr 7 '14 at 1:14
  • Well, you could try to block a specific ip range via iptables. For example: iptables -A INPUT -m iprange --src-range 67.0.0.1-67.255.255.255 -j DROP – Pathin Apr 7 '14 at 17:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.