email alert on root login

[FleroviumUranus]

vi .bash_profile
Scroll down to the end of the file and add the following line:


echo 'ALERT - Root Shell Access on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d"(" -f2 | cut -d")" -f1`" [email protected]

i follow this but not getting the emails on root login
what i missing?

 

[SeLLeRoNe]

Have you changed [email protected]?

Regards

 

[scsi]

Because the file should be .bashrc?

http://www.crucialp.com/resources/t...ecuring/email-alert-root-ssh-login-e-mail.php

 

[SeLLeRoNe]

Oh, that's right xD didnt notice

 

[FleroviumUranus]

in my root directory
. .. .bash_history .bash_profile .custombuild .rnd setup.sh .ssh


i need to mkdir .bashrc or i an searching on wrong place

 

[FleroviumUranus]

suggest somthing

 

[zEitEr]

Hello,

Make sure, your root is using bash

grep ^root: /etc/passwd | cut -d\: -f7

Then... make sure that the code is working, just put in a file test.sh and run

sh ./test.sh

you should get an email. If not, then read exim logs.

 

[SeLLeRoNe]

You need to create the file, not the directory.

Do:

nano ~/.bashrc

and put in there that line

Save and exit

Regards

 

[FleroviumUranus]

Hello,

Make sure, your root is using bash

grep ^root: /etc/passwd | cut -d\: -f7

Then... make sure that the code is working, just put in a file test.sh and run

sh ./test.sh

you should get an email. If not, then read exim logs.

test.sh: line 3: [email protected]: command not found


code
#!bin/bash
echo 'ALERT - Root Shell Access (YourserverName) on:' `date` `who` |
mail -s "Alert: Root Access from `who | cut -d'(' -f2 | cut -d')' -f1`"
[email protected]

 

[FleroviumUranus]

test.sh: line 3: [email protected]: command not found


code
#!bin/bash
echo 'ALERT - Root Shell Access (YourserverName) on:' `date` `who` |
mail -s "Alert: Root Access from `who | cut -d'(' -f2 | cut -d')' -f1`"
[email protected]

and this is the output of first command

[root@server ~]#grep ^root: /etc/passwd | cut -d\: -f7
/bin/bash

 

[SeLLeRoNe]

Put on a single line the command.

Regards

 

[zEitEr]

Yes, Andrea is right, your code should look like this:

#!bin/bash
echo 'ALERT - Root Shell Access (YourserverName) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d'(' -f2 | cut -d')' -f1`" [email protected]

 

[FleroviumUranus]

working now