root access by email

[Blisk]

I am looking for something that will notify me by email everytime someone login as root. I have found this script to put in bash file of root. But it doesn't send the IP of person which is logged in as root.
Even that I have read, that there is other ways where can someone pass through to root access and script won't send an email.

Is there more relaible way to get notification by email, tha this below?

1. Login to your server and su to root!

2. cd /root

3. pico .bashrc

4. Scroll to the end of the file then add the following:
echo 'ALERT - Root Shell Access (YourserverName) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d"(" -f2 | cut -d")" -f1`" you(at)yourdomain.com

[reginaldperrin]

A solution that I can think of involves monitoring of logs.
Presumable your system has logging activated, and it logs to a seperate machine?
You 'simply' ensure that login events are included in the list of things to log, and have a script that looks at the log in question:
if log entry == root login event;
then send email;
endif;

Sounds simple (and at the same time complicated) I know, but if someone can login as root to an individual machine, then they can do anything, including deleting all traces of their having been there.
Unless of course it is logged to a seperate machine, one to which they cannot have access.

Hope this helps.

[alf55]

I am looking for something that will notify me by email everytime someone login as root. I have found this script to put in bash file of root. But it doesn't send the IP of person which is logged in as root.
Even that I have read, that there is other ways where can someone pass through to root access and script won't send an email.

Is there more reliable way to get notification by email, that this below?

1. Login to your server and su to root!

2. cd /root

3. pico .bashrc

4. Scroll to the end of the file then add the following:
echo 'ALERT - Root Shell Access (YourserverName) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d"(" -f2 | cut -d")" -f1`" you(at)yourdomain.com

Using "who am i" rather than "who"

echo 'ALERT - Root Shell Access (YourserverName) on:' `date` `who am i` | mail -s "Alert: Root Access from `who am i1" you@yourdomain.com

[kurtdriver]

Just wanted to point out that whoami has no spaces.

[alf55]

It is the "who" command with two arguments "am" and "i" which is what I wrote not the command "whoami".

[kurtdriver]

I stand corrected, I had no idea that would work, but it does.