Get email notification of root login

Categories General Info

Have root logins emailed to you

1. Login to your server and su to root, unless you logged in as root already.

2. cd /root (unless your default login folder is already root)

3. pico .bashrc (or use your favorite editor)

4. Scroll to the end of the file then add the following:
echo ‘ALERT – Root Shell Access (YourserverName) on:’ `date` `who` | mail -s “Alert: Root Access from `who | cut -d”(” -f2 | cut -d”)” -f1`”

Replace YourServerName with the handle for your actual server for example dwhs4 @

Replace you @ with your actual email address for example support @

5. Crtl + X then Y

Now logout of SSH, close the connection and log back in! You should receive an email address of the root login alert a few minutes afterwards.