LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 08-15-2004, 08:41 AM   #1
gamehack
Member
 
Registered: Jun 2003
Location: Sevenoaks, UK
Distribution: Ubuntu
Posts: 183

Rep: Reputation: 30
SSH Alert when root attempts to log


Hello all,

I am searching for a tool which will produce a sound alert when an attempt to connect through ssh is made

Thanks
 
Old 08-15-2004, 10:17 AM   #2
trickykid
LQ Guru
 
Registered: Jan 2001
Posts: 24,149

Rep: Reputation: 235Reputation: 235Reputation: 235
Not sure of a tool already out there but it wouldn't be hard to write a script yourself to check the logs say every couple of minutes or so. Not sure why you'd want this, to me it would get annoying as much as some of my own servers get hit with someone trying to login as root thru ssh. I just ignore them since logging in directly as root is disabled, which is the smartest thing to do.
 
Old 08-15-2004, 10:47 AM   #3
p-static
Member
 
Registered: Jul 2004
Distribution: Gentoo
Posts: 101

Rep: Reputation: 15
You could just add a beep noise to one of the login scripts, but i'm not sure if that would play for remote logins.
 
Old 06-03-2009, 06:44 AM   #4
nileshparmar
LQ Newbie
 
Registered: Mar 2009
Posts: 8

Rep: Reputation: 0
No problem, check out this nice tutorial on email notification for root logins. Keeping track of who logs into your server and when is very important, especially when you're dealing with the super user account. We recommend that you use an email address not hosted on the server your sending the alert from.

So lets get started!

1. Login to your server and su to root, I know the irony!

2. cd /root

3. pico .bashrc

4. Scroll to the end of the file then add the following:
echo 'ALERT - Root Shell Access (YourserverName) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d'(' -f2 | cut -d')' -f1`" you@yourdomain.com

Replace YourServerName with the handle for your actual server
Replace you@yourdomain.com with your actual email address

5. Crtl + X then Y

Now logout of SSH, close the connection and log back in! You should receive an email address of the root login alert a few minutes afterwards.

Note: This is a great tool for servers that have multiple admins or if you give someone SSH access for whatever reason, although you should give out the root password to as few people as humanly possible and be sure to change it often.

This will not magically alert you when a hacker runs the latest kernel exploit on your server and logs into SSH because they will create their own SSH/telnet connection. You should keep your system up to date, install a firewall and follow the latest security releases.



Similar Articles : Compile 2.6.7, 2.6.8, 2.6.8.1, 2.6.9, 2.6.10, 2.6.11.6 Kernel w/module-init-tools, Rkhunter Installation, Detect and Clean a hacked server T0rnkit Tutorial, How to install KISS Firewall, How to Disable Telnet, How to install mod_security for Apache, How to install BFD (Brute Force Detection), How to install APF (Advanced Policy Firewall), E-mail Alert on Root SSH Login, Mask Your Web Server for Enhanced Security, Guide to Chkrootkit - checking for intruders, Creating a Welcome message for SSH logins, Disable Direct Root Login, RootCheck - Root Check, Changing APF log for TDP/UDP drop's
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
ssh...log files that store the login attempts Bgrad Linux - Networking 4 03-29-2010 09:40 AM
root cant log in to ssh Red Squirrel Linux - Software 2 08-26-2005 12:17 PM
ssh won't log root in m2azer Linux - General 9 12-25-2004 11:37 PM
Increase Log in attempts from 1 chrisk5527 Linux - Newbie 5 01-31-2004 02:07 PM
Non-root users can log in to SSH but not read Home Directory? Bizanshee Linux - Software 1 09-18-2002 07:01 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 02:07 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration