Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Can you help me with this problem please? How can I set e-mail alerting after SSH login when port 22 is NATed? I use Linux Debian 7. I have used these iptables rules:

eth0 - external network, eth1 - internal network    
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

Thanks for your replies.

share|improve this question
    
still not clear what the question is, when you looking for an email altert after login: askubuntu.com/questions/179889/… –  bersch Mar 27 at 22:43
    
@bersch, Thanks I tried it. But it does not work. I need alert after open SSH session, but SSH server runs on next system, behind NAT. This alert have to generate on this system which works as NAT. –  Mato Mar 27 at 23:08
add comment

1 Answer 1

If you are trying to generate email alerts when this host NATs ssh to another server, then log the connections and use a log monitoring tool to send the notification. A tool like logcheck will send notifications hourly. Others can be configured to send notifications as events appear in the log.

If you want to generate the message on the target server try using /etc/host.allow rules. The first rule should accept local (not-NATed) connections. The second should accept connections (NATed) and send an email. Here is an example: (change you@example.com to your email address).

sshd:   192.168.0.0/16 127.0.0.1 [::1] [fe::/8]

sshd:   ALL : \
        spawn (/bin/echo "SSH connection to %N from %n[%a] allowed" | \
        /usr/bin/mailx -s "SSH Allowed" you@example.com)
share|improve this answer
    
thanks. Paragraph 1 is my case. When you see to my iptables rules in first post, how can effectively log activity with iptables please? On my machine that works as NAT runs special tool on port 22 that forwards network traffic after analysis (SSH session and comands are recorded). –  Mato Mar 28 at 17:00
    
@Mato If you are running a tool to snoop the SSH session just have it email on connection, or wrap it and log as in the second case. –  BillThor Mar 29 at 4:22
    
Thanks. So I have made file /etc/host.allow and I put this: (I have used sendemail): sshd: ALL : \ spawn (/bin/echo "SSH connection to %N from %n[%a] allowed" | \ sendEmail -o tls=no -f my@mail.tld -t to@mail.tld -u "SSH LOGIN" -m "message" -s smtp_parameters -xu login -xp password) but it does not work... Any idea please? –  Mato Mar 29 at 18:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.