I know the who command showing me all logged in users. But I want to somehow informed when someone but me loggs into my system. Any applet? Would also be nice if the applet shows the number of distinct users logged in, meaning having a login shell and established ssh connection.

  • BTW: can someone comment on break in attempts. Is then still /etc/profile.d executed? I guess it depends on the break in, so for brute force ssh attacks this might hold, by rights escalation of running services it might not. Ahh it seems user monitoring is not an easy task. – math Feb 12 '16 at 8:49

For the part of notification when someone loggs in your system, you could try to put a little script in a /etc/profile.d script. Using notify-send (part of the libnotify-bin package) you could try this :


notify-send -t 3000 "User logged in" `whoami`

and then, every time someone will log in your system you will be notified.

EDIT: So, it doesn't work well :( If you configured a mail server on your machine, you can use the mail command instead of notify-send.

But according to the post here, the better solution would be a pam_exec script.

  • Good idea, but no need to make it executable and no need to have a shebang, because files in /etc/profile.d/ are sourced. Only login shells (virtual terminals and ssh login) and some GUI login execute profile initialization. – enzotib Jan 4 '12 at 11:57
  • @enzotib : thanks for the tips, I corrected my answer :) – Cédric Julien Jan 4 '12 at 12:41
  • Ok, I've tried but without no luck so far. The reason is, that one user cannot notify another easily. Therefore some environment variables have to be set, see: g-loaded.eu/2007/11/18/…. So far I've some executable which does the stuff but not when I login!?! If I just source /etc/profile.d/notify_log.sh after login via ssh, the notification is send. I guess it is not executed properly after login. I observed /var/log/auth.log without luck. Any help? – math Jan 4 '12 at 13:35
  • I found the reason: I use ZSH and /etc/zsh/zprofile is empty it should be supposed to source /etc/profile which in turn should source /etc/profile.d/*.sh, but does nothing at all! >-(.. I will source this explicitly then and check all other installed shells, since I don't know which login shells are used by all LDAP users.. Anyway thanks. – math Jan 4 '12 at 13:50
  • @brubelsabs : oups, I edited my answer with other solutions – Cédric Julien Jan 4 '12 at 13:50

We do it by creating a file /etc/profile.d/notify.sh with the following content:


subject="Privileged Account logon used"
    echo "$message" | mail -s "$subject" -r "$sender" -Smtp=mail.example.com "$recepient"

Assuming mailx is installed.

  • Yes, sometimes you may miss a desktop notification, but the mail usually remains. – math Feb 12 '16 at 8:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.