[GLLUG] Anyone doing server login notifications?

[John Edwards]

Hi

On Wed, Dec 02, 2015 at 03:19:55AM +0000, Leo Francisco wrote:
> This is one is for the sysadmins out there. Does anyone know a good way
> of setting up email notifications that are sent out every time someone
> logins in to a (in this case Ubuntu) server?
<snip>

Main questions would be how quickly do you need to know, and is this a
security requirement that you need to stop users from altering?

If the login launches a shell then the simplest solution would be to
add a mail (or mutt) command to one of system wide files that is read
when a login shell is launched (eg /etc/profile). Problem with this is
that a user can stop this from happening, either by 

If you need to have the email sent immediately (or within a minute)
then you will probably need to look at hooking into the PAM login
process. The libpam-script may do the job, but I've never used it.
Also if you've never edit PAM onfiguration files it can be quite
tricky and leave you with a system which is either too open or unable
to login.

If you can wait about an hour then a program like logcheck or logwatch
could be configured to search for login patterns in the log files and
send a summary email every hour. This is the safest way, but also the
slowest.


-- 
#---------------------------------------------------------#
|    John Edwards   Email: john at cornerstonelinux.co.uk    |
#---------------------------------------------------------#
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: Digital signature
URL: <http://mailman.lug.org.uk/pipermail/gllug/attachments/20151202/04af92a3/attachment.sig>