[SOLVED] application which can pop up like gtalk when some one accesses my server

tkmsr · 01-31-2011, 11:56 AM

Hi all I am not sure as what should I be looking on Google hence asking here.I have a Ubuntu server with Public IP on which I have a few websites and SSH accounts.I want to know if there is any application/daemon which I can install so that when ever some one does an SSH connection to my server I get a pop up on my laptop that is like gtalk messages which just gives me some one pop up with a message that user so and so loged in to server.Or some other application which can also tell me when ever http requests are made to my server so that I can be aware or if some one tries a DOS (in this case requests might be difficult to detect) but I get a pop up which says that so and so services is trying to access your server from outside.Other than checking log files is there any way for these things which I asked?

petebow4 · 01-31-2011, 12:41 PM

You could use scripting (BASH , python, etc) to monitor log files and send updates via email to your gmail account (or any email address for this matter).

Granted this won't create a google talk pop up; for that you would need to take a look at the Google Talk Api. You could create a google account for your computer and then had the computer "message" you with a status update. But this would take some digging through the google api list, which may or may not have what you're looking for.

Off the top of my head I do not know of any apps which will do this right out of the box, but I'm no google

tkmsr · 01-31-2011, 01:02 PM

Quote:

Originally Posted by petebow4

You could use scripting (BASH , python, etc) to monitor log files and send updates via email to your gmail account (or any email address for this matter).

Why to re invent the wheel I feel some sys admin must have felt the need for the same and must have done it.May be the right keyword is what I need to search LQ can help here.

petebow4 · 01-31-2011, 03:18 PM

Fair enough. If you could live with getting an email from your system, there are plenty of examples of how to do so out there.

And then reading through log files via bash isn't that difficult to code and again there are lots of examples out there. You would want to set up cron job to run your script periodically. Your script would simply parse each line in the logfile, looking for relevent keywords. Once it finds one, it simply copies that line and emails it to you.

It should be pretty simple to do!

tkmsr · 01-31-2011, 10:39 PM

I am not looking for any of the solutions you mentioned.

pjcoyle · 02-26-2011, 01:35 PM

tkmsr - I set up just the system you are talking about this week. I installed and configured a jabber server (ejabberd). I then wrote a very simple php script with an XMPP library to read from STDIN and message the results through the jabber server. Then it is simply a matter of amending your syslog to pipe whichever events you want through the script.

It may be possible to do this without installing the jabber server if you can connect to googletalk directly. I haven't tried this.

Let me know if you need any more details, I'm happy to share the scripts but they are pretty basic.

tkmsr · 02-26-2011, 01:59 PM

Please do share I would love to read what you developed.
Irrespective of small size or basic functionality.

pjcoyle · 02-26-2011, 02:27 PM

So, the php library I've used is xmpphp which has some handy examples in it. My script is simply:

Code:

#!/usr/local/bin/php -q
<?php
include "XMPPHP/XMPP.php";
$conn = new XMPPHP_XMPP('localhost', 5222, 'xmpp-user', 'xmpp-password', 'xmpphp', 'xmpp-domain');
$conn->connect();
$conn->processUntil('session_start');
$logpipe = fopen( "php://stdin", "r" ) or die( "Could not open the pipe");
while( !feof( $logpipe) )
{
 $conn->message('xmpp-desitination', fgets( $logpipe ) );
}
fclose( $logpipe );
$conn->disconnect();
?>

Replace the xmpp-* with your values. The jabber server I've got running locally so I've made a user called syslog who sends everything to me.

My entry in syslog.conf looks like this:

Code:

*.*             |/root/to/script.php

which roots all syslog messages to the xmpp script. This results in a large volume of messages so be a bit more selective in what you log. As you are just after ssh you might choose auth.* which would give you all logins.

If you need anything else let me know.

tkmsr · 02-26-2011, 02:36 PM

Your solution is good I understood.
I am using a Ubuntu machine here I do not see syslog.conf so what is the equivalent of syslog.conf for Ubuntu.
Do you mean to say /var/log/auth.log or some thing else.

pjcoyle · 02-26-2011, 02:43 PM

/var/log/auth.log is the place where the messages are written to. You need to change the daemon which controls where these messages are written. I'm running FreeBSD, where the configuration file is /etc/syslog.conf. I think the Ubuntu one on recent versions is /etc/rsyslog.conf but it may not be - I'm not very familiar with Ubuntu.

tkmsr · 02-26-2011, 02:45 PM

Ok pjcoyle no problems thanks for your input.

pjcoyle · 02-26-2011, 02:46 PM

Hope you get it working!

tkmsr · 02-26-2011, 02:47 PM

Sure I will get it.Till now the solutions which I came across yours is the simplest one.