3

I was wondering if it is possible to set it up in such a way that on a failed login Ubuntu will send me an email? And of course if the computer is not connected to the internet when the attempt occurs, then it should send me the email once there is an internet connection again rather than just attempting, failing, and then never alerting me to that login. The email should contain the date and time (day/month/year - hour:minute:second) of the failed login attempt, and also (though optionally - in other words, an answer which doesn't explain how to do this is acceptable as it may be a big ask) any action taken, so for instance if I have it setup to lock the person out for 5 minutes or something then it should alert me to the fact that it has taken that action. I am running Ubuntu GNOME 15.10 with GNOME 3.18, is something like this possible?

  • @muru: The bit about telling me if any action has been taken is no absolutely necessary, it would be nice, but if you can provide me with an answer which doesn't include that then that is fine. But the thing about the email(s) piling up until they can be sent should be the case because otherwise they can just disconnect my machine from the internet while they do it to avoid detection and that's just stupid to allow them to do it like that... – user364819 Feb 1 '16 at 13:03
  • Eh, if they got that level of access to your system, why can't they just disable the email script? – muru Feb 1 '16 at 13:05
  • @muru: Well, this is assuming they haven't just dropped to root prompted, but instead that they are attempting to login through the standard way. And probably aren't expecting the script, this is to defend against normal people trying to get access, not people who know what they are doing. – user364819 Feb 1 '16 at 13:09
  • Those assumptions are ridiculous. Why would normal people disconnect the network? Or use the standard way? – muru Feb 1 '16 at 13:10
  • @muru: Because my machine does not have Wifi so I have a very obvious Ethernet cable going into it that easily falls out just by itself... :D – user364819 Feb 1 '16 at 13:13
6
+200

Accessing logs

One with root privileges can make use of the command lastb to see all failed login attempts in the computer, also a much more detailed log file that records failed login attempts in the time span of a week can be found at /var/log/auth.log (no root privileges necessary) and the bad login attempts will be listed like this:

MONTH  DAY HH:MM:SS MACHINE lightdm: pam_unix(lightdm:auth): authentication failure; logname= uid=0 euid=0 tty=:0 ruser= rhost=  user=USER

Script

You can write a script to read those log files and send them to you by e-mail whenever a new bad login attempt is logged. Here is my take on that:

First let's trigger the script execution whenever someone tries to login and fail. PAM keeps the /var/log/auth.log so we can use it to trigger our script. Open /etc/pam.d/common-auth:

sudo vim /etc/pam.d/common-auth

Then, just before the line:

auth    requisite                       pam_deny.so

Add this:

auth [default=ignore] pam_exec.so seteuid /usr/bin/report_badlogin

And in the lines above change any occurrence of success=1 to success=2 and, if any, success=2 to success=3 and so on.

Now create the specified script:

sudo vim /usr/bin/report_badlogin

Write in it the commands to send you the report email:

#! /bin/sh
# report_badlogin

if grep -F -x -v -f /var/log/auth.log.old /var/log/auth.log | grep -n 'authentication failure' | mail -s "Bad login attempt notification" "yourpersonal@email.com"; then
  cp -f /var/log/auth.log /var/log/auth.log.old
  chown YOURUSERNAME /var/log/auth.log.old
fi

exit 0

Brief explanation: First grep gets the changes on the log file by subtracting it from the last saved copy of it (.old). Second grep gets just the line that matters, the one that informs you the date, time and the user the login was attempt on. mail sends you that one line as an email with subject Bad login attempt notification. If the email was sent successfully auth.log.old is updated, but as the scripting is running as root we set back the ownership over the file to your user.

Save it and close it (VIM command :wq).

Make sure that the script has execution permission:

sudo chmod a+x /usr/bin/report_badlogin

Manually create a first copy of auth.log:

cp /var/log/auth.log{,.old}

Dealing with no internet connection scenarios

The potential invader can disconnect your PC from the internet while he attempts to guess the password to prevent the notification email, but even when he does that his bad login attempts are all being logged to auth.log.

What you can do to still get the notifications as soon as possible is to trigger a slightly different script upon a successful login with your machine connected to the internet. To do that let's use ~/.bashrc script, that is executed whenever you login:

vim ~/.bashrc

Add these lines to the end of the file:

# Pending bad login attempts notification
sh /usr/bin/report_pending

Save it and quit. Now create that script:

sudo vim /usr/bin/report_pending

And write into it the following:

#! /bin/sh
# report_pending

if grep -F -x -v -f /var/log/auth.log.old /var/log/auth.log | grep -n 'authentication failure'; then
    if grep -F -x -v -f /var/log/auth.log.old /var/log/auth.log | grep -n 'authentication failure' | mail -s "Bad login attempt notification" "yourpersonal@email.com"; then
        cp -f /var/log/auth.log /var/log/auth.log.old
    fi
fi

exit 0

Brief explanation: This script does almost the same as the first, but as it is always executed on login, we first check for the existence of pending reports, otherwise whenever you login you would receive a blank email. Notice that this script is not running with root privileges, so there is no need to change auth.log.old ownership after it's updated.

Now just add execution permission to the script:

sudo chmod a+x /usr/bin/report_pending

Configure SMTP settings

In order to the email to be sent install mailutils and sSMTP:

sudo apt-get install mailutils ssmtp

Configure sSMTP:

sudo vim /etc/ssmtp/ssmtp.conf

Edit it to something like this:

root=yoursmtpemail@gmail.com    
mailhub=smtp.gmail.com:587    
AuthUser=yoursmtpemail    
AuthPass=PASSWORD    
UseSTARTTLS=YES    
hostname=yoursmtpemail@gmail.com    
FromLineOverride=YES

If you are not using GMail just change it to your provider.

I recommend you to create an email solely to be used as SMTP server (yoursmtpemail@gmail.com) and not to use your personal email, because as you can see you are storing this email's password in a plain text file (only root can access this file, but it's not a good practice anyway, although I don't know how to do it in any other way...).

In case of GMail (I haven't tried with other providers) you still need to allow Access for less secure apps. If you try running echo "Test mail" | mail -s "Testing" yourpersonal@email.com you should receive an email in yoursmtpemail@gmail.com informing you that access to that email was denied to an application that did not meet the security level of GMail and that if you want you can Learn more about allowing access for less secure applications, click on it and GMail will eventually present you the option to allow it.

Done!

  • 1
    Thorough answer, using new lines in the output of lastb was what I had in mind too, +1. – Jacob Vlijm Feb 5 '16 at 11:18
  • I have the program OSSEC HIDS installed, which just sends me the mail from my machine, and just shows my machine's address as the address it came from, so is there no way to do it like it does, or like the other answer does in terms of sending mail? And piling up the mail... – user364819 Feb 5 '16 at 11:19
  • Well, of course you can use other methods to send the email, I don't have the software you have and I am not familiar with it, so I can't help you in such specific way. If you are familiar with usage of that software you can just adapt my script to send the grep results through it. Later today I'll add some things to my answer to avoid problems if someone just disconnect your PC from the Internet. – Rodrigo Martins Feb 5 '16 at 12:35
  • @ParanoidPanda I updated the answer to cover the no internet connection scenario and also fixed an error the script was yielding because of file permissions. – Rodrigo Martins Feb 19 '16 at 19:24
  • (1) I notice that on my system the last log line does not appear in the mail messsage. It only gets written to the log file after the mail is sent. I'd swap the order in pam.d/common_auth if it the pam control flow weren't so obscure (2) There is a brief interval of between when you grep auth.log and copy it to backup. Anything that gets written in that brief interval will not be transmitted in neither this mail nor the next. That can be avoided by copying to a tmp file before the grep, and then copying tmp to last. – Craig Hicks Jul 15 '18 at 8:16
1

This is probably overkill, but ConfigServer Firewall (CSF) and LFD can help to monitor and protect your machines.

Sending notifications about failed login attempts is just one of its many features. This should work out of the box, delivering notification email to root.

In order to receive mail on a different machine, you'll need a program that can send mail. Installing the mail-transport-agent package may be enough, but I usually install an exim4 server, which can queue up delivery if you are offline (for up to 3 days I believe).

CSF does not come as an Ubuntu package, so you'll need to follow their installation instructions:

cd /usr/src
rm -fv csf.tgz
wget https://download.configserver.com/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy