To me the question is still unclear, so I try to answer the question contained in the first paragraph. How to log SSH logins?
I will also limit my answer to all *nix systems with PAM support. This is a relevant point, because you do not limit the scope of your question by giving a particular OS.
Okay, here's what I used in the past:
sshrc. If you add a file named that in
/etc/ssh (location may vary!), it will be executed by interactive (i.e. with shell) SSH connections.
Downside here is that you won't get informed about the stuff that is also relevant, such as SFTP (
sftp-internal subsystem) connections.
However, we have an inroute here.
We can use PAM with
pam_exec.so to our advantage and limit its effect to SSH by adding this to
/etc/pam.d/sshd (for me it's the last non-comment line):
session optional pam_exec.so stdout /etc/your_email_script.sh
This will ensure that the script gets run as a privileged user (relevant if you prefer to call the sendmail binary to send off the mail) and that there is hardly anything the user can do to avoid this script being run. You can effectively limit access to that script to only
The part with
optional you should adjust if needed. Relevant reading:
You may also want to play with how early on you want to execute your script.
What you see to miss is. You have so many other ways of locking down the server. For starters: don't allow passwords. Stick to key-only authentication. Make sure that people with only SFTP access do not have additional access:
Match group sftponly
will let members of group
sftponly only use SFTP and no port forwarding etc, and limit the scope to
/home (file/folder permissions do the rest).
will only let members of a group
ssh-users even log on via SSH. That is, you can limit SSH logon to a subset of your user base.
should be set and relevant users be made sudoers instead.
should ensure that password over which you have limited control cannot be used to log on.
can ensure that users aren't allowed to manage their
authorized_keys file, but requires you to do it on their behalf.