I am new to linux administration and was looking for a good way to get e-mail alerts when a user logs in. I was thinking this might be useful as a security monitoring tool to allow me to see who is on the system in almost real time. I know that using the 'last' command I can see who logged in and when along with IP they used to log in. Does anyone know of a way I could get the output of this command e-mailed to me when it changes? Is there a better way to do this?
1 Answer
The standard way of monitoring access to Linux box is by forwarding authentication messages usually available in /var/log/security. (taken from the authpriv.* facility)
Various methods to forward these messages can be used. Many organisations forward these logs with the syslog protocol, using for instance rsyslog. Rsyslog allows to send mails if a mail server is configured on the box, although it is usually forwarded to another box where it is stored for further use (alerting, historical analysis, legacy storage, ...)
That's to begin with...
/etc
(like/etc/profile
) that gets executed when a user logs in. This might be a better place to accomplish what you want.