Set up an email alert for SSH connections (Ubuntu + Openssh + Sendemail)

Looking to monitor my SSH server and trigger an email alert for any SSH connections to my Ubuntu server I've pulled together a very basic script that will send an email when someone logs into an SSH server. Read on...



My ssh server is based around Openssh. Openssh executes the file /etc/ssh/sshrc if it exists when a user logs in via SSH. By default I did not have an sshrc file so I created one as follows to enable an email script to be executed on connection.

From the sshd manual:

If the file ~/.ssh/rc exists, sh(1) runs it after reading the environment files but before starting the user’s shell or command. It must not produce any output on stdout; stderr must be used instead. If X11 forwarding is in use, it will receive the "proto cookie" pair in its standard input (and DISPLAY in its environment). The script must call xauth(1) because sshd will not run xauth automatically to add X11 cookies.

The primary purpose of this file is to run any initialization routines which may be needed before the user’s home directory becomes accessible; AFS is a particular example of such an environment.

This file will probably contain some initialization code followed by something similar to:
if read proto cookie && [ -n "$DISPLAY" ]; then
if [ ‘echo $DISPLAY | cut -c1-10‘ = ’localhost:’ ]; then
# X11UseLocalhost=yes
echo add unix:‘echo $DISPLAY |
cut -c11-‘ $proto $cookie
else
# X11UseLocalhost=no
echo add $DISPLAY $proto $cookie
fi | xauth -q -
fi

If this file does not exist, /etc/ssh/sshrc is run, and if that does not exist either, xauth is used to add the cookie.

The email sshrc script outlined below relies on the SendEmail program. SendEmail from Brandon Zehm is a very simple email program that doesn't require an email server to be setup on your machine i.e. no need to configure postfix, sendmail or exim4. The current challenge is the password is stored in clear text in the script which is a trade off for using such a nice and simple email app to address this I suggest 1) the script has appropriate read permissions set via chmod to stop people looking into it, and 2) use a disposable email address with a password that is unique for this purpose.

The email sent by the script below captures the:

username of the user that connect;
hostname of the machine logged into;
IP of the user that connects;
ISP of the user that connects;  
Reverse DNS of the user that connects;
Date and time of the connection; and 
a reminder of the script file which has generated the email.

 How to get it all working: 

1. Install sendemail, ssl perl and ssleay perl:

sudo apt-get install sendemail libio-socket-ssl-perl libnet-ssleay-perl whois -y

2. Create /etc/ssh/sshrc:

sudo gedit /etc/ssh/sshrc 


3. Add the following lines to your /etc/ssh/sshrc file (this script is design to use Google as the SMTP email server):

DATE=`date "+%d.%m.%Y %Hh%Mm"`
IP=`echo $SSH_CONNECTION | awk '{print $1}'`
REVERSE=`dig -x $IP +short`
WHO=$(whois $IP | grep desc | tail -1 | cut -c 17-)

MESSAGE="SSH Connection from $USER on "`echo "$HOSTNAME"`
MESSAGE=$MESSAGE`echo "\nIP : $IP \n"`
MESSAGE=$MESSAGE`echo "\nISP : $WHO \n"`
MESSAGE=$MESSAGE`echo "\nHost: $REVERSE \n"`
MESSAGE=$MESSAGE`echo "\nDate: $DATE \n"`
MESSAGE=$MESSAGE`echo "\nFrom /etc/ssh/sshrc \n"`

SUBJECT="SSH Connection from "$USER" on "$HOSTNAME

sendemail -v -f addresstosendemailfrom -s smtp.gmail.com:587 -xu username -xp 'password' -t addresstosendemailto -o tls=yes -u $SUBJECT -m "$MESSAGE" > /dev/null 2>&1

This script is also here since I haven't easily figure how to embed code in blogger yet
Save and exit 

Note if ~/.ssh/rc exists the /etc/ssh/sshrc script will not be executed. 

> /dev/null 2>&1  - note this line is used to redirect the sendemail command output to /dev/null. This effectively suppresses the sendemail command so that it operates silently i.e. when you log in via SSH the SSH terminal does not see the output of the email script. You can run the script without > /dev/null 2>&1 but you'll see the output of the command in the ssh terminal and it may alert anyone connecting that their log in has tripped an email.

$HOSTNAME - hostname doesn't work for me in the email I can't figure out why, the script works fine on the local machine but not when executed from SSHRC, if anyone has a solution please add a comment. Thanks