1

Is there a way to send an email when anyone connects via SSH (or LuCI for that matter)? I'm setting up my router to log to a flash drive so I guess I could grep the logs or possibly look at connections periodically with:

netstat -ntu | grep 22

but this feels more than clunky. Could I use: cat /proc/net/nf_conntrack somehow?

1 Answer 1

3

Normally it would be a good idea to do that via PAM, but you're on a router...
You could put something like

echo 'Root Shell Access | mail -s "Root Shell Access" your@yourdomain.com

in .bashrc or /etc/profile, but then again that would fire every time you access your routers shell.

Better yet, modify or create /etc/ssh/sshrc with the following contents:

ip=`echo $SSH_CONNECTION | cut -d " " -f 1`

logger -t ssh-wrapper $USER login from $ip
echo "User $USER just logged in from $ip" | sendemail -q -u "SSH Login" -f "Originator <from@address.com>" -t "Your Name <your.email@domain.com>" -s smtp.server.com &

This will effectively notify you by email anytime someone logs in through SSH, and the login will be logged in the syslog.

Note: You'll need the `sendemail` package for the email notification to work.

Note: works with port forwarding, but with -N option not.

Source

1
  • Thanks so much that works perfectly. The only change I made was to ssmtp as it seems like verizon doesn't support relay.
    – rainkinz
    Sep 5, 2014 at 22:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.