0

I am new to linux administration and was looking for a good way to get e-mail alerts when a user logs in. I was thinking this might be useful as a security monitoring tool to allow me to see who is on the system in almost real time. I know that using the 'last' command I can see who logged in and when along with IP they used to log in. Does anyone know of a way I could get the output of this command e-mailed to me when it changes? Is there a better way to do this?

2
  • Usually there is a script in /etc (like /etc/profile) that gets executed when a user logs in. This might be a better place to accomplish what you want.
    – Steve
    Sep 18, 2014 at 18:59
  • 1
    Remember that your users have a reasonable expectation of privacy and that sysadmins have special responsibilities to protect said data (and privacy) in most jurisdictions.
    – Jan
    Sep 18, 2014 at 22:33

1 Answer 1

0

The standard way of monitoring access to Linux box is by forwarding authentication messages usually available in /var/log/security. (taken from the authpriv.* facility)

Various methods to forward these messages can be used. Many organisations forward these logs with the syslog protocol, using for instance rsyslog. Rsyslog allows to send mails if a mail server is configured on the box, although it is usually forwarded to another box where it is stored for further use (alerting, historical analysis, legacy storage, ...)

That's to begin with...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .