Ravi Saive
I am an experienced GNU/Linux expert and a full-stack software developer with over a decade in the field of Linux and Open Source technologies

Each tutorial at TecMint is created by a team of experienced Linux system administrators so that it meets our high-quality standards.

Join the TecMint Weekly Newsletter (More Than 156,129 Linux Enthusiasts Have Subscribed)
Was this article helpful? Please add a comment or buy me a coffee to show your appreciation.

35 thoughts on “How to Get Root and User SSH Login Email Alerts”

  1. Create a alert on my server such that if anyone other than my and my manager IP’s login to the server we should get an mail based alert with the user ID & ip address.

    Please help.

    Reply
  2. Hi, I just tested this on my Linux box and it works well. However, if i need to reverse the script, how do i achieve that?

    echo ‘ALERT – Root Shell Access (ServerName) on:’ `date` `who` | mail -s “Alert: Root Access from `who | cut -d'(‘ -f2 | cut -d’)’ -f1`” [email protected]

    Reply
  3. Hello!

    I get this when attempting to install mailx the above command.

    Reading package lists ... Done
    Building the dependency tree
    Reading status information ... Done
    The mailx package is a virtual package provided by:
      mailutils 1: 3.1.1-1
      bsd-mailx 8.1.2-0.20160123cvs-4
    You must explicitly select a package to install.
    
    E: The "mailx" package does not have a version that can be installed
    

    As the message says, apt-get install mailutils works.

    Thank you for sharing your knowledge.

    Reply
  4. When i am trying the command i am getting.

    line 13: unexpected EOF while looking for matching `''
    line 14: syntax error: unexpected end of file
    

    i didn’t find any solutions

    Reply
  5. After I originally left a comment I seem to have clicked on the Notify me when new comments are added- checkbox and now each time a comment is added I receive four emails with the exact same comment. There has to be a way you are able to remove me from that service? Thanks a lot!

    Reply
  6. When I tried logging in as root, I get this error message. what does this mean?

    mail: option requires an argument -- 's'
    Try 'mail --help' or 'mail --usage' for more information.
    bash: $'Alert: Root Access from ip-address\nip-address': command not found
    
    Reply
  7. Sir, I need one help from you.

    can’t I get any user login email alert through the mail? I have tried but mail.err and mail log gives me an error. below is the code (changed hostname, email)

    echo 'ALERT - Root Shell Access (ServerName) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d'(' -f2 | cut -d')' -f1`" [email protected]

    I have written a script for capturing an image and email later notification

    Reply
      • Ravi – do you know why I would see :0 instead of an IP Address? Please let me know.

        ALERT – Root Shell Access (server-here) on: Mon May 1 11:52:31 EDT 2017 username-here tty7 2017-05-01 11:48 (:0)

        Reply
        • @Mike,

          Have you added following code correctly to your .bashrc file?

          echo 'ALERT - Root Shell Access (ServerName) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d'(' -f2 | cut -d')' -f1`" [email protected]

          Reply
          • Yes – and it works great every time I log in! But I had one time where I did not log into the system but got an email and it was from “:0” so I was wondering if that may have been the system or something else?

          • @Ravi,any word on the “:0”? It works great when I log in but one time when no one logged in I got an email with “:0” as the login … I thought it was odd…

  8. @Ravi Saive – what does it mean when I see :0 instead of an IP Address? See below:

    ALERT – Root Shell Access (server-here) on: Mon May 1 11:52:31 EDT 2017 username-here tty7 2017-05-01 11:48 (:0)

    Reply
  9. Hi, I think your site might be having browser compatibility issues. When I look at your blog in Safari, it looks fine but when opening in Internet Explorer, it has some overlapping. I just wanted to give you a quick heads up! Other then that, very good blog!

    Reply
  10. Hi,
    I always get the message (mail.log) “no recepient address found in message header”
    Where is this recepient address specified?

    Thanks for yr help im desperate..

    With kind regards,

    Edwin

    Reply
  11. Hi how can we set ssh mail alert othere then one specific ip.

    I want to set ssh login root mail alert same working as well now my requirment is i want to get ssh root alert mail if other then one specific ip are
    login.

    Thanks & regdras
    Randhr

    Reply
  12. Hi there,

    It’s possible to configure this alert only in some specific time of the day ?

    Like when i’m out of the company ?

    Thank you.

    Reply
  13. Dear Ravi Saive,

    I want to thank you, I learned a lot from your posts. This post works great. After I put these codes in the bashrc file, I receive email notification immediately when I login SSH.

    The smtp port 25 should be open and we should make sendmail or postfix working. Otherwise no emails go out.

    And if the email account has message arrival notification function to mobile phone, we receive sms messages when users login with SSH.

    Thank you very much.

    Lampk

    Reply
  14. Gr8 document. is it possible get system or root access alert on android mobile phone ? i checked with gnokii but for that we need nokia phone but i want to configure it on android phone.

    Reply

Leave a Reply to Savannah Bradshaw Cancel reply

Thank you for taking the time to share your thoughts with us. We appreciate your decision to leave a comment and value your contribution to the discussion. It's important to note that we moderate all comments in accordance with our comment policy to ensure a respectful and constructive conversation.

Rest assured that your email address will remain private and will not be published or shared with anyone. We prioritize the privacy and security of our users.