This is a very useful script that will alert you whenever someone logs into your server via ssh, it you ever get this and it’s not you, then it may be too late but who knows, there may be a way to do something about it before it gets worse.<\/p>\n
To setup email notification, login to your server as root.
\nEdit .bashrc<\/p>\n
\r\nnano .bashrc\r\n<\/code><\/pre>\nadd the following line at the end, changing \u201cServerName\u201d to the hostname of your server and \u201cemail@thisaddress.com\u201d to your own email address.<\/p>\n
echo 'ALERT - Root Shell Access (ServerName) on:' `date` `who` | mail -s \"Alert on ServerName: Root Access from `who | cut -d\"(\" -f2 | cut -d\")\" -f1`\" youremail@address.com\r\n<\/code><\/pre>\nMake sure to change ServerName for the real server name and the email address it will be sent to, save and exit.<\/p>\n
If you’re on CenOS you can add:<\/p>\n
-r “ServerName Root Login Alert <noreply@servername.domain.com>”<\/p>\n
right before your email address and it will set a from name and email,<\/p>\n
for Debian that would be:<\/p>\n
-a “From: ServerName Root Login Alert <noreply@servername.domain.com>”<\/p>\n
Next time someone logs on as root, you will get an email about this and this can be done for any user, you only have to make sure that the user can email out from your server.<\/p>\n
<\/p>\n
<\/p>\n
<\/p>\n