I believe my linux machine to be reasonably protected from external login. But since I am mildy paranoid, I would like to be alerted when there is a login attempt made to the server, whether successful or not.
Scanning the site, I cannot find any unison way of doing this. As far as I can tell, for unsuccessful attempts logcheck has been recommended, and for successful ones the sshrc or (perhaps even more) pam_exec method. I like two-stones-in-one-throw methods, and wonder whether any of you pros know if there is a way of getting one of these methods to do both? PAM in particular seems to be a smart place to do things, since it is after all, from what I can tell, the central authentication system on my ubuntu machine.