In this tutorial we’ll show you how to configure your VPS so that every time someone logs in, you receive an email alerting you to this fact. This is kind of a “lowend intrusion detection system” though it may have other uses. For example, if you need to audit what staff are doing or if you’ve got third parties accessing your system.

Configuring Email

We don’t need to be able to receive mail, but we do need to be able to send it. For this purpose, we will use postfix.

apt-get install postfix

This will ask you various configuration questions.  Set your server up as an Internet site and specify the fully-qualified domain name:

We will also need mailx:

apt-get install mailutils

Make sure that reverse DNS is set for your VPS. You can do this in your provider’s panel. This will help ensure that email from your VPS does not go to spam.

If you are not using ipv6, be sure to disable it in Postfix:

postconf "inet_protocols = ipv4"
systemctl restart postfix

Now you should be able to send a test email to ensure mail is working:

echo "test email from $(hostname)" | mailx -s "$(hostname) email works" raindog308@raindog308.com

Check your email:

Configuring Alerts

We’re going to use Linux’s Pluggable Authentication Modules system to notify us when someone logs in. First, we need to create a script for this purpose. Place the following in /usr/local/bin/login_notification.sh

#!/bin/sh

FROM="root@$(hostname)"
TO="you@somewhere.com"
if [ "$PAM_TYPE" != "close_session" ]; then
  SUBJECT="SSH Login: $PAM_USER from $PAM_RHOST on $(hostname)"
  # You can put anything you want for the body of the email.
  # Here I'll send the environment.
  env | /usr/bin/mailx -r "$FROM" -s "$SUBJECT" "$TO"
fi

Make the file executable

chmod 755 /usr/local/bin/login_notification.sh

Make sure that the following line exists in /etc/ssh/sshd_config and is not commented out.

UsePAM yes

Now place the following line in /etc/pam.d/sshd:

session optional pam_exec.so seteuid /usr/local/bin/login_notification.sh

Now login, and you should receive an email:

• Author
• Recent Posts

raindog308

Dread Lord of LowEnd Content at LowEndBox

I'm raindog308, techno polymath and long-time LowEndTalk community Administrator. My technical interests include all things Unix, perl, python, golang, shell scripting, vintage operating systems such as MVS, and relational database systems such as Oracle, PostgreSQL, and MySQL.

I also enjoy using LEBs! I have an empire of little guys for VPNs, larger guys for apps, and big guys for databases and storage. When I'm not in front a screen I'm into German Shepherd dogs, quality knives, target shooting, theology, tabletop roleplaying games, and forest hiking.

I enjoy writing technical articles here on LowEndBox to help people get more out of their systems. You can find me on LowEndTalk @raindog308

Latest posts by raindog308 (see all)

• Early Black Friday Offer: VersaWeb has a Dedi Deal in Las Vegas, Dallas, and Miami! - November 23, 2024
• LowEndBoxTV: Are All Hetzner Locations Alike?No!And Piotr Has the Proof: “This is Clearly Not the Same Processor” - November 22, 2024
• One Week From Tomorrow…THE WORLD WILL LOSE THEIR MINDS!Lines Are Already Forming! - November 21, 2024