Alert by email when root user logins by shell

The following command added to ~/.bash_profile will alert a specified address when a root user signs in.

echo 'ALERT - Root Shell Access () on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d"(" -f2 | cut -d")" -f1`" [email protected]
source .bashrc

.bashrc is sourced because, at least on Debian squeeze, .bashrc isnt executed if .bash_profile exists.

You are reading this post on Joel G Mathew’s tech blog. Joel's personal blog is the Eyrie, hosted here.