Wed, 16 May 2007 Show #52: THUD! & Mandriva Metisse Minutes
Links
Contact
The code that alerts me every time the root user logs in to one of my servers (set whatever email address you like in root's .forward file). Call this file /etc/profile.d/lalert.sh: #!/bin/sh # <user login alert> cuser=`/usr/bin/whoami` alert_addy="root" alert_usrs="root bin adm mysql admin" for usr in `echo $alert_usrs`; do if [ "$usr" == "$cuser" ] || [ "$alert_usrs" == "" ]; then hostname=`/bin/hostname` date=`date +"%b %e %H:%M:%S"` tmz=`date +"%z"` cuser_info=`/usr/bin/who` >> /dev/null 2>&1 cuser_last=`last $usr -n 10` >> /dev/null 2>&1 rm -f /etc/profile.d/.tmp cat > /tmp/.usralert-$$ <<EOF This alert was generated in response to an interactive login made by user $usr on $hostname; at which time the date was $date. Further information is detailed below on this login event (all time stamps are GMT $tmz): Applicable 'who' output: $cuser_info Applicable 'lastlog' output: $cuser_last EOF cat /tmp/.usralert-$$ | mail -s "Login alert ($cuser) on $hostname" $alert_addy rm -f /tmp/.usralert-$$ fi done # </user login alert> Comments[5] |
Wed, 16 May 2007 This is the OGG for show #52 Comments[0] |
Wed, 9 May 2007 Show #51: Hosting Puppy, The End of the NAS Caper, and Kelly's Rant Minutes
Links Contact
Comments[4] |
Wed, 9 May 2007 This is the OGG for show #51. Comments[1] |
