SSH Email Alerts

[Asphyxia]

Ready for ghetto?

w | grep "pts" | wc | cut -d " " -f 7

This gives you a number.

Let's log this number now!

Make a folder:

mkdir /security

w | grep "pts" | wc | cut -d " " -f 7 > /security/wwc.txt

Now can we compare these numbers using an if statement? We need to generate an email only if the WC of SSH mismatches.

Time to begin making a bash script (shell script) inside of /security...

nano /security/wwc.sh

We want to use this logic:

WCOUNT=`head -1 /security/wwc.txt`
echo $WCOUNT
NEWCOUNT=`w | grep "pts" | wc | cut -d " " -f 7`
if [ $WCOUNT != $NEWCOUNT ]
then
        w | grep "pts" | wc | cut -d " " -f 7 > /security/wwc.txt
        w > /security/w.txt
        echo "Subject: Testing" | /sbin/sendmail -f [email protected] -v [email protected] < /security/w.txt
        rm /security/w.txt
fi

We obviously must generate an email whenever the wc mismatches, because this would mean a change in activity...

I also went ahead and did chmod +x on the wwc.sh file.

Next we would need to add a cron entry, maybe using crontab -e

* * * * * /security/wwc.sh

This should do what we want.