Email alert on Root Login

This will allow you to be notified instantly via email whenever someone logs into your server as root.

ssh into your server

su to root

sudo -i

or su -

cd to /root

cd /root

edit your .bashrc file

vim .bashrc

add the following to the end of the file

echo 'ALERT - Root Shell Access (YourserverName) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d"(" -f2 | cut -d")" -f1`" you@yourdomain.com

Replace YourServerName with the name of your server.

Replace you@yourdomain.com with the email address you want the alerts sent to.

:x to save and exit

logout from your server, close the connection and log back in.

You will receive an email alert of the root login after a few minutes.