Hi, everyone. I wrote a simple bash script to alert me when anyone logs into my CentOS Linux server. It simply sends me an email with the username for the account that logged in, the hostname of the server, the date and time, and the IP recorded in the SSH_CONNECTION environment variable. I realize that, as a security measure, it's very weak, but I plan on expanding it. yesterday, I logged in from a new location, resumed a screen session, and proceeded to create a new window. My script reported the new IP upon the initial login, but, when I created the new screen window, it sent the IP that was recorded when I first created the screen session. Do you know of a way to force screen to update the SSH_CONNECTION environment variable when a new window is created? Is there a better place/way to find the IP of the current SSH session? Do you know of a free tool that can report account logins as they happen and send emails and or text messages? Thank you! Jad Wauthier
This information should be in /var/log/auth.log or similar, using the auth and authpriv facilities. More info here: https://unix.stackexchange.com/questions/59525/difference-between-authpriv-a... Chris On Wed, Jan 27, 2016 at 07:58:30AM -0600, Jad Wauthier wrote:
Hi, everyone.
I wrote a simple bash script to alert me when anyone logs into my CentOS Linux server. It simply sends me an email with the username for the account that logged in, the hostname of the server, the date and time, and the IP recorded in the SSH_CONNECTION environment variable. I realize that, as a security measure, it's very weak, but I plan on expanding it. yesterday, I logged in from a new location, resumed a screen session, and proceeded to create a new window. My script reported the new IP upon the initial login, but, when I created the new screen window, it sent the IP that was recorded when I first created the screen session.
Do you know of a way to force screen to update the SSH_CONNECTION environment variable when a new window is created? Is there a better place/way to find the IP of the current SSH session? Do you know of a free tool that can report account logins as they happen and send emails and or text messages?
Thank you!
Jad Wauthier
_______________________________________________ Blind-sysadmins mailing list Blind-sysadmins@lists.hodgsonfamily.org https://lists.hodgsonfamily.org/listinfo/blind-sysadmins
Thank you, Chris. I'll look into that option. On 1/27/2016 10:10 AM, Chris Nestrud wrote:
This information should be in /var/log/auth.log or similar, using the auth and authpriv facilities. More info here:
https://unix.stackexchange.com/questions/59525/difference-between-authpriv-a...
Chris
On Wed, Jan 27, 2016 at 07:58:30AM -0600, Jad Wauthier wrote:
Hi, everyone.
I wrote a simple bash script to alert me when anyone logs into my CentOS Linux server. It simply sends me an email with the username for the account that logged in, the hostname of the server, the date and time, and the IP recorded in the SSH_CONNECTION environment variable. I realize that, as a security measure, it's very weak, but I plan on expanding it. yesterday, I logged in from a new location, resumed a screen session, and proceeded to create a new window. My script reported the new IP upon the initial login, but, when I created the new screen window, it sent the IP that was recorded when I first created the screen session.
Do you know of a way to force screen to update the SSH_CONNECTION environment variable when a new window is created? Is there a better place/way to find the IP of the current SSH session? Do you know of a free tool that can report account logins as they happen and send emails and or text messages?
Thank you!
Jad Wauthier
_______________________________________________ Blind-sysadmins mailing list Blind-sysadmins@lists.hodgsonfamily.org https://lists.hodgsonfamily.org/listinfo/blind-sysadmins
Blind-sysadmins mailing list Blind-sysadmins@lists.hodgsonfamily.org https://lists.hodgsonfamily.org/listinfo/blind-sysadmins
participants (2)
-
Chris Nestrud -
Jad Wauthier