monitoring login

[Jamon Camisso]

On 10/11/2010 02:19 AM, Rajinder Yadav wrote:
> On 10-10-10 10:58 AM, Fernando Duran wrote:
>> Hi,
>>
>> I do this actually in my servers, by adding this line to /etc/profile:
>>
>>   echo "`whoami` logged in at `date` from `echo $SSH_CLIENT`" | mail -s
>> "`hostname` login" me-hcDgGtZH8xNBDgjK7y7TUQ at public.gmane.org
> 
> i want something that will work from any account, even if someone
> creates a new account for a backdoor
> 
> what i would like is a way to monitor a login even systemwide and then
> have a script execute to fire off an email

That's exactly what Fernando's line does. Since /etc/profile is read by
all valid login shells, it effectively works for any account.

Jamon
--
The Toronto Linux Users Group.      Meetings: http://gtalug.org/
TLUG requests: Linux topics, No HTML, wrap text below 80 columns
How to UNSUBSCRIBE: http://gtalug.org/wiki/Mailing_lists