Re: [Nolug] login monitor

> >> Does anyone have ideas or pointers how to monitor user logons and set
> >> system to immediately e-mail about it?
> >
> > Depend on shell, the /etc/profile (bash) or /etc/csh.cshrc (*csh) gets run
> > upon user login. Add something like
> >
> > echo "$USER logged in" | mail -s'User login' you@somewhere.com
> >
> > to those files.

You could also run a command from cron that will look in /var/log/messages
for something on this line:
sshd[14352]: Accepted password for brad from ::ffff:xxx.xxx.xxx.xxx port
32839 ssh2

somethign like
grep "Accepted password" /var/log/messages

of course with this you'll get the same list over and over...

bb

___________________
Nolug mailing list
nolug@nolug.org
Received on 10/21/04