E-Mail Alert on Linux Root Login

To increase the security of your linux server you can configure Bash so it sends an e-mail whenever someone logs in using the root account. This is how you do it:

[root@VPS1 ~]# vim /root/.bashrc

At the bottom just add the following line:

echo 'ALERT - Root Shell Access (SERVERNAME) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d"(" -f2 | cut -d")" -f1`" EMAIL

Just replace SERVERNAME with the name of your server and EMAIL with your e-mail address. The next time you login with the root account you will receive an e-mail like this one:

ALERT – Root Shell Access (SERVERNAME) on: Mon Apr 22 20:16:24 CEST 2013 admin pts/0 2013-04-22 20:16 (1234.cm-5-1a.dynamic.ziggo.nl)

The e-mail will show you the server name but also the hostname of the user the logged in using the root account.

That’s all there is to it! If you have any questions feel free to ask.