Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can you help me with this problem please? How can I set e-mail alerting after SSH login when port 22 is NATed? I use Linux Debian 7. I have used these iptables rules:

eth0 - external network, eth1 - internal network    
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

Thanks for your replies.

share|improve this question
still not clear what the question is, when you looking for an email altert after login: askubuntu.com/questions/179889/… – user55518 Mar 27 '14 at 22:43
@bersch, Thanks I tried it. But it does not work. I need alert after open SSH session, but SSH server runs on next system, behind NAT. This alert have to generate on this system which works as NAT. – Mato Mar 27 '14 at 23:08

If you are trying to generate email alerts when this host NATs ssh to another server, then log the connections and use a log monitoring tool to send the notification. A tool like logcheck will send notifications hourly. Others can be configured to send notifications as events appear in the log.

If you want to generate the message on the target server try using /etc/host.allow rules. The first rule should accept local (not-NATed) connections. The second should accept connections (NATed) and send an email. Here is an example: (change you@example.com to your email address).

sshd: [::1] [fe::/8]

sshd:   ALL : \
        spawn (/bin/echo "SSH connection to %N from %n[%a] allowed" | \
        /usr/bin/mailx -s "SSH Allowed" you@example.com)
share|improve this answer
thanks. Paragraph 1 is my case. When you see to my iptables rules in first post, how can effectively log activity with iptables please? On my machine that works as NAT runs special tool on port 22 that forwards network traffic after analysis (SSH session and comands are recorded). – Mato Mar 28 '14 at 17:00
@Mato If you are running a tool to snoop the SSH session just have it email on connection, or wrap it and log as in the second case. – BillThor Mar 29 '14 at 4:22
Thanks. So I have made file /etc/host.allow and I put this: (I have used sendemail): sshd: ALL : \ spawn (/bin/echo "SSH connection to %N from %n[%a] allowed" | \ sendEmail -o tls=no -f my@mail.tld -t to@mail.tld -u "SSH LOGIN" -m "message" -s smtp_parameters -xu login -xp password) but it does not work... Any idea please? – Mato Mar 29 '14 at 18:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.