Linux安全, Root SSH登录通知脚本

Linux安全, Root SSH登录通知脚本

建立
vi /root/.bashexec

内容
#!/bin/bash
tmpout=tmpout.txt
stringz=”$(tail -n 1 /var/log/secure | grep root | grep opened | sed ‘s/.*by\(.*\)(.*/\1/’ | awk ‘{print $1″”$2}’)”
echo -e “The local root account has been accessed by user $stringz” > $tmpout
echo -e “\nThe system last updated on: $(sed -n ‘/Updated:/h;${;g;p;}’ < /var/log/yum.log | cut -dU -f1)” >> $tmpout
echo -e “\nThe last five users to access the system (including active):” >> $tmpout
echo -e “$(last -n 5 | sed ‘/^wtmp/d’)” >> $tmpout
echo -e “\nUptime Report: $(uptime)” >> $tmpout
/bin/mail -s “$(hostname) root account accesssed by $stringz” [email protected] < $tmpout
rm -f $tmpout

注意windows下保存的时候 为unix文本格式
执行文件
vi /root/.bashrc

添加执行
sh /root/.bashexec

就是登录的时候 调用脚本 发送通知email
如果收到email 你没登录 那么就需要检查服务器安全了