monitoring login

[Chris F.A. Johnson]

On Mon, 11 Oct 2010, Jamon Camisso wrote:

> On 10/11/2010 02:19 AM, Rajinder Yadav wrote:
>> On 10-10-10 10:58 AM, Fernando Duran wrote:
>>> Hi,
>>>
>>> I do this actually in my servers, by adding this line to /etc/profile:
>>>
>>>   echo "`whoami` logged in at `date` from `echo $SSH_CLIENT`" | mail -s
>>> "`hostname` login" me-hcDgGtZH8xNBDgjK7y7TUQ at public.gmane.org
>>
>> i want something that will work from any account, even if someone
>> creates a new account for a backdoor
>>
>> what i would like is a way to monitor a login even systemwide and then
>> have a script execute to fire off an email
>
> That's exactly what Fernando's line does. Since /etc/profile is read by
> all valid login shells, it effectively works for any account.

      It is not read by [t]csh.

-- 
    Chris F.A. Johnson, <http://cfajohnson.com>
    Author:
    Pro Bash Programming: Scripting the GNU/Linux Shell (2009, Apress)
    Shell Scripting Recipes: A Problem-Solution Approach (2005, Apress)
--
The Toronto Linux Users Group.      Meetings: http://gtalug.org/
TLUG requests: Linux topics, No HTML, wrap text below 80 columns
How to UNSUBSCRIBE: http://gtalug.org/wiki/Mailing_lists