Send email when anyone logs on

You should use a solucion for log monitoring like OSSEC, it will look on your logs for security information (including login, sudo, etc.) and send you an e-mail when the alert is important.

It's easy to configure and you can raise the alert level for e-mails or include an alert-by-email on the specific alert.

It can also do configurable active-response, blocking IPs and denying access for a period of time by default.


you could put this in your .bashrc

echo 'ALERT - Root Shell Access to' $(hostname) 'on:' `date` `who` \
| mail -s "Alert: Root Access from `who | cut -d"(" -f2 | cut -d")" -f1`" YOUREMAIL

Slight change of adams solution which doesn't break if root is logged into more than one terminals:

login_info="$(who | head -n1 | cut -d'(' -f2 | cut -d')' -f1)"
message="$(
printf "ALERT - Root Shell Access (%s) on:\n" "$(hostname)"
date
echo
who
)"
mail -s "Alert: Root Access from ${login_info}" admin <<< "${message}"