I believe my linux machine to be reasonably protected from external login. But since I am mildy paranoid, I would like to be alerted when there is a login attempt made to the server, whether successful or not.

Scanning the site, I cannot find any unison way of doing this. As far as I can tell, for unsuccessful attempts logcheck has been recommended, and for successful ones the sshrc or (perhaps even more) pam_exec method. I like two-stones-in-one-throw methods, and wonder whether any of you pros know if there is a way of getting one of these methods to do both? PAM in particular seems to be a smart place to do things, since it is after all, from what I can tell, the central authentication system on my ubuntu machine.

Any advice?


1 Answer 1


Well you could use cron with a silly little script to check /var/log/auth.log every 10 minutes. If you set it up correctly, cron will email output wherever you like so we just need a script to run:

cat /var/log/auth.log | perl -MDate::Parse -ne '
  print if /login|ssh/ && /^(\S+\s+\d+\s+\d+:\d+:\d+)\s/ && str2time($1) > time-600'

This is based around this answer on SO by F. Hauri.

That's just looking for items with login or ssh in. You might want to add more or just exclude some. But on my system here's what it generates:

Aug 29 10:19:50 bert sudo:      oli : TTY=pts/10 ; PWD=/home/oli ; USER=root ; COMMAND=/bin/login
Aug 29 10:19:52 bert login[15544]: pam_unix(login:session): session opened for user oli by oli(uid=0)
Aug 29 10:19:54 bert login[15544]: pam_unix(login:session): session closed for user oli
Aug 29 10:20:11 bert sshd[15614]: Accepted publickey for oli from ::1 port 41663 ssh2: RSA XXXXXXXXXXXXXXXXXXXXXXXXXXXX
Aug 29 10:20:11 bert sshd[15614]: pam_unix(sshd:session): session opened for user oli by (uid=0)

Save that script as something like /usr/local/sbin/checkauth (and chmod u+x it) and then you can add a root crontab line with sudo crontab -e:

*/10 * * * * /usr/local/sbin/checkauth

Stick a MAILTO="[email protected]" line at the top of the cron file too and (provided there's a mailserver installed — install postfix if not) you'll get emails of the output, iff there is any output.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .