Email on failed login attempt?

Question

I was wondering if it is possible to set it up in such a way that on a failed login Ubuntu will send me an email? And of course if the computer is not connected to the internet when the attempt occurs, then it should send me the email once there is an internet connection again rather than just attempting, failing, and then never alerting me to that login. The email should contain the date and time (day/month/year - hour:minute:second) of the failed login attempt, and also (though optionally - in other words, an answer which doesn't explain how to do this is acceptable as it may be a big ask) any action taken, so for instance if I have it setup to lock the person out for 5 minutes or something then it should alert me to the fact that it has taken that action. I am running Ubuntu GNOME 15.10 with GNOME 3.18, is something like this possible?

Answer 1

Accessing logs

One with root privileges can make use of the command lastb to see all failed login attempts in the computer, also a much more detailed log file that records failed login attempts in the time span of a week can be found at /var/log/auth.log (no root privileges necessary) and the bad login attempts will be listed like this:

MONTH  DAY HH:MM:SS MACHINE lightdm: pam_unix(lightdm:auth): authentication failure; logname= uid=0 euid=0 tty=:0 ruser= rhost=  user=USER

---

Script

You can write a script to read those log files and send them to you by e-mail whenever a new bad login attempt is logged. Here is my take on that:

First let's trigger the script execution whenever someone tries to login and fail. PAM keeps the /var/log/auth.log so we can use it to trigger our script. Open /etc/pam.d/common-auth:

sudo vim /etc/pam.d/common-auth

Then, just before the line:

auth    requisite                       pam_deny.so

Add this:

auth [default=ignore] pam_exec.so seteuid /usr/bin/report_badlogin

And in the lines above change any occurrence of success=1 to success=2 and, if any, success=2 to success=3 and so on.

Now create the specified script:

sudo vim /usr/bin/report_badlogin

Write in it the commands to send you the report email:

#! /bin/sh
# report_badlogin

if grep -F -x -v -f /var/log/auth.log.old /var/log/auth.log | grep -n 'authentication failure' | mail -s "Bad login attempt notification" "[email protected]"; then
  cp -f /var/log/auth.log /var/log/auth.log.old
  chown YOURUSERNAME /var/log/auth.log.old
fi

exit 0

Brief explanation: First grep gets the changes on the log file by subtracting it from the last saved copy of it (.old). Second grep gets just the line that matters, the one that informs you the date, time and the user the login was attempt on. mail sends you that one line as an email with subject Bad login attempt notification. If the email was sent successfully auth.log.old is updated, but as the scripting is running as root we set back the ownership over the file to your user.

Save it and close it (VIM command :wq).

Make sure that the script has execution permission:

sudo chmod a+x /usr/bin/report_badlogin

Manually create a first copy of auth.log:

cp /var/log/auth.log{,.old}

Dealing with no internet connection scenarios

The potential invader can disconnect your PC from the internet while he attempts to guess the password to prevent the notification email, but even when he does that his bad login attempts are all being logged to auth.log.

What you can do to still get the notifications as soon as possible is to trigger a slightly different script upon a successful login with your machine connected to the internet. To do that let's use ~/.bashrc script, that is executed whenever you login:

vim ~/.bashrc

Add these lines to the end of the file:

# Pending bad login attempts notification
sh /usr/bin/report_pending

Save it and quit. Now create that script:

sudo vim /usr/bin/report_pending

And write into it the following:

#! /bin/sh
# report_pending

if grep -F -x -v -f /var/log/auth.log.old /var/log/auth.log | grep -n 'authentication failure'; then
    if grep -F -x -v -f /var/log/auth.log.old /var/log/auth.log | grep -n 'authentication failure' | mail -s "Bad login attempt notification" "[email protected]"; then
        cp -f /var/log/auth.log /var/log/auth.log.old
    fi
fi

exit 0

Brief explanation: This script does almost the same as the first, but as it is always executed on login, we first check for the existence of pending reports, otherwise whenever you login you would receive a blank email. Notice that this script is not running with root privileges, so there is no need to change auth.log.old ownership after it's updated.

Now just add execution permission to the script:

sudo chmod a+x /usr/bin/report_pending

Configure SMTP settings

In order to the email to be sent install mailutils and sSMTP:

sudo apt-get install mailutils ssmtp

Configure sSMTP:

sudo vim /etc/ssmtp/ssmtp.conf

Edit it to something like this:

[email protected]    
mailhub=smtp.gmail.com:587    
AuthUser=yoursmtpemail    
AuthPass=PASSWORD    
UseSTARTTLS=YES    
[email protected]    
FromLineOverride=YES

If you are not using GMail just change it to your provider.

I recommend you to create an email solely to be used as SMTP server ([email protected]) and not to use your personal email, because as you can see you are storing this email's password in a plain text file (only root can access this file, but it's not a good practice anyway, although I don't know how to do it in any other way...).

In case of GMail (I haven't tried with other providers) you still need to allow Access for less secure apps. If you try running echo "Test mail" | mail -s "Testing" [email protected] you should receive an email in [email protected] informing you that access to that email was denied to an application that did not meet the security level of GMail and that if you want you can Learn more about allowing access for less secure applications, click on it and GMail will eventually present you the option to allow it.

Done!

Answer 2

This is probably overkill, but ConfigServer Firewall (CSF) and LFD can help to monitor and protect your machines.

Sending notifications about failed login attempts is just one of its many features. This should work out of the box, delivering notification email to root.

In order to receive mail on a different machine, you'll need a program that can send mail. Installing the mail-transport-agent package may be enough, but I usually install an exim4 server, which can queue up delivery if you are offline (for up to 3 days I believe).

CSF does not come as an Ubuntu package, so you'll need to follow their installation instructions:

cd /usr/src
rm -fv csf.tgz
wget https://download.configserver.com/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh