Question

I’m trying to write a script that informs the user when someone has logged in on the machine via ssh.

My current idea is to parse the output of ‘w’ using grep in intervals.

But that’s neither elegant nor performant. Has anyone got a better idea how to implement such a program?

Any help would really be appreciated!

Answer 1

On Ubuntu (and I’d guess all other Debian distros, if not all Linuces), the file /var/log/auth.log records successful (and unsuccessful) login attempts:

sshd[XXX]: pam_unix(sshd:session): session opened for user XXX 

You could set up a very simple monitor using this command (note that you have to be root to see the auth log):

sudo tail -F /var/log/auth.log | grep sshd