E-Mail Alert on Linux Root Login

To increase the security of your Linux server, you can configure Bash so it sends an e-mail whenever someone logs in using the root account. This is how you do it:

[root@VPS1 ~]# vim /root/.bashrc

At the bottom add the following line:

echo 'ALERT - Root Shell Access (SERVERNAME) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d"(" -f2 | cut -d")" -f1`" EMAIL

Just replace SERVERNAME with the name of your server and EMAIL with your e-mail address. The next time you log in with the root account, you will receive an e-mail like this one:

ALERT – Root Shell Access (SERVERNAME) on: Mon Apr 22 20:16:24 CEST 2013 admin pts/0 2013-04-22 20:16 (1234.cm-5-1a.dynamic.ziggo.nl)

The e-mail will show you the server name and the hostname of the user who logged in using the root account.

That’s all there is to it! If you have any questions feel free to ask.