mjhjmtu

My Linux workstation is part of a shared Network. I would like to receive a notification email every time someone SSH my workstation. For that purpose, I opened the file ~/.bash_profile in gedit (my ~/.bash_profile file is completely empty) and I wrote the following lines:

IP="$(echo $SSH_CONNECTION | awk 'print $1')"
HOST=$(hostname)
TIME_DATE_STAMP=$(date +"%e %b %Y, %a %r")

echo 'The '$IP' logged into '$HOST' on '$ TIME_DATE_STAMP'.' | mail -s 'SSH 
Login Notification' MY_EMAIL_ADDRESS

I still don't get a notification email! Please notify me what I am doing wrong?

To get around this issue:
When I use the command "who -H" int terminal. It pulls out a list for all the incoming ssh actions to my workstation. My questions is: How the command "who" generate this information? what is the source of its data, so I can rely on it to get the ssh data that I want?

You can pull out the information you want from the command "who", then pipe it to the command mail. An example command:

 who | awk 'print $1" "$3" "$4" " $5' | tail -1 | mail -s 'WARNING: SSH Notification' EMAIL_ADDRESS

Save the previous command as a bash, and schedule it in crontab to run every specific minutes (e.g. every 30 minutes).

you can pipe the output of the command last .

last | head -1 | mail -s 'WARNING:' EMAIL_ADRESS

A couple things:

• Your ~/.bash_profile is only kicked off when you login. These other users may not be logging in as you.




• For observing who is logging into your CentOS machine over ssh, parse the output of /var/log/secure.

It'd look something like this:

tail -f /var/log/secure | while read LOGLINE
do
 [[ "$LOGLINE" == *"logged in"* ]] && mail -s 'SSH Notification' $MY_EMAIL_ADDRESS
done

EDIT: You've edited your question to ask about how the who command works. Look I'm not a C developer but here's the source code of the who command if you really want a peek at how it works. I don't think this is what you're looking for, however - and I know've no other way to assist you. Even if you could create a script to check if someone is logged in leveraging cron & who, there's always a possibility that someone could login & logout between your runs. Logs are the way to go.