SSH Email Alerts

Asphyxia

Owner
Administrator
Apr 25, 2015
1,845
2
2,199
327
Ready for ghetto?

Code:
w | grep "pts" | wc | cut -d " " -f 7

This gives you a number.

Let's log this number now!

Make a folder:
Code:
mkdir /security

Code:
w | grep "pts" | wc | cut -d " " -f 7 > /security/wwc.txt

Now can we compare these numbers using an if statement? We need to generate an email only if the WC of SSH mismatches.

Time to begin making a bash script (shell script) inside of /security...

Code:
nano /security/wwc.sh

We want to use this logic:
Code:
WCOUNT=`head -1 /security/wwc.txt`
echo $WCOUNT
NEWCOUNT=`w | grep "pts" | wc | cut -d " " -f 7`
if [ $WCOUNT != $NEWCOUNT ]
then
        w | grep "pts" | wc | cut -d " " -f 7 > /security/wwc.txt
        w > /security/w.txt
        echo "Subject: Testing" | /sbin/sendmail -f [email protected] -v [email protected] < /security/w.txt
        rm /security/w.txt
fi

We obviously must generate an email whenever the wc mismatches, because this would mean a change in activity...

I also went ahead and did chmod +x on the wwc.sh file.

Next we would need to add a cron entry, maybe using crontab -e
Code:
* * * * * /security/wwc.sh

This should do what we want.
 
Top