Mayur's BLOG

1. Login to the server via SSH using as root ID.
2. Ensure that you’re at home directory of root. The open up the .bash_profile for editing using pico or vi by typing one of the following commands at command shell line:

pico .bash_profile
vi .bash_profile
3. Scroll down to the end of the file and add the following line:


echo 'ALERT - Root Shell Access on:' `date` `who` | mail -s "Alert: Root Access
from `who | cut -d"(" -f2 | cut -d")" -f1`" user@example.com

Replace user@email.com with the actual email account
address that you want to the root access alert notification been sent to. Note that you can change the text contains in the email alert too. The text starting with first ALERT is written as email body, and you can add in other info such as host name or change the wordings. The second Alert is the email title which you can change to your own too.

Now logout and login again as root, you should receive an email alert at your inbox. The security trick should works on most popular flavor of Linux such as RedHat, CentOS, Ubuntu, FreeBSD and etc.