35 thoughts on “How to Get Root and User SSH Login Email Alerts”

  1. After I originally left a comment I seem to have clicked on the Notify me when new comments are added- checkbox and now each time a comment is added I receive four emails with the exact same comment. There has to be a way you are able to remove me from that service? Thanks a lot!

    Reply
  2. When I tried logging in as root, I get this error message. what does this mean?

    mail: option requires an argument -- 's'
    Try 'mail --help' or 'mail --usage' for more information.
    bash: $'Alert: Root Access from ip-address\nip-address': command not found
    
    Reply
  3. Sir, I need one help from you.

    can’t I get any user login email alert through the mail? I have tried but mail.err and mail log gives me an error. below is the code (changed hostname, email)

    echo 'ALERT - Root Shell Access (ServerName) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d'(' -f2 | cut -d')' -f1`" [email protected]

    I have written a script for capturing an image and email later notification

    Reply
      • Ravi – do you know why I would see :0 instead of an IP Address? Please let me know.

        ALERT – Root Shell Access (server-here) on: Mon May 1 11:52:31 EDT 2017 username-here tty7 2017-05-01 11:48 (:0)

        Reply
        • @Mike,

          Have you added following code correctly to your .bashrc file?

          echo 'ALERT - Root Shell Access (ServerName) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d'(' -f2 | cut -d')' -f1`" [email protected]

          Reply
          • Yes – and it works great every time I log in! But I had one time where I did not log into the system but got an email and it was from “:0” so I was wondering if that may have been the system or something else?

          • @Ravi,any word on the “:0”? It works great when I log in but one time when no one logged in I got an email with “:0” as the login … I thought it was odd…

  4. @Ravi Saive – what does it mean when I see :0 instead of an IP Address? See below:

    ALERT – Root Shell Access (server-here) on: Mon May 1 11:52:31 EDT 2017 username-here tty7 2017-05-01 11:48 (:0)

    Reply
  5. Hi, I think your site might be having browser compatibility issues. When I look at your blog in Safari, it looks fine but when opening in Internet Explorer, it has some overlapping. I just wanted to give you a quick heads up! Other then that, very good blog!

    Reply
  6. Hi,
    I always get the message (mail.log) “no recepient address found in message header”
    Where is this recepient address specified?

    Thanks for yr help im desperate..

    With kind regards,

    Edwin

    Reply
  7. Hi how can we set ssh mail alert othere then one specific ip.

    I want to set ssh login root mail alert same working as well now my requirment is i want to get ssh root alert mail if other then one specific ip are
    login.

    Thanks & regdras
    Randhr

    Reply

Got something to say? Join the discussion.

Have a question or suggestion? Please leave a comment to start the discussion. Please keep in mind that all comments are moderated and your email address will NOT be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.