SSH Login Alerts by Email

Does SSH Monitor email you on every SSH login?

No. SSH Monitor sends an email only when the failed attempts in the new log lines reach FAILED_THRESHOLD. A successful login on its own does not trigger anything. When an alert does go out, it includes the last 5 successful logins from those lines so you can check them.

If you want to know about each login as it happens, use the PAM setup below. You can run it next to SSH Monitor: one tells you about logins, the other about failed attempts.

What does SSH Monitor show about successful logins?

The script reads lines like these from the auth log:

Mar  3 10:05:00 web-01 sshd[2211]: Accepted publickey for deploy from 192.0.2.10 port 51000 ssh2: ED25519 SHA256:...
Mar  3 11:42:17 web-01 sshd[2390]: Accepted password for alice from 192.0.2.44 port 52114 ssh2

It reads every Accepted <method> line (password, publickey, keyboard-interactive/pam), turns the log time into a full date and time, sorts by it and keeps the 5 newest, oldest first. For classic syslog lines, which have no year, it uses the current year, or last year for months later than the current one.

Each login whose log time falls before 08:00 or after 18:59 is also listed under an off-hours warning. You can change the hours with BUSINESS_HOURS_START and BUSINESS_HOURS_END.

How do you get an email for every SSH login?

Use pam_exec, a standard Linux PAM module that runs a command during login. When sshd opens a session, pam_exec runs your script and passes the user and remote host in environment variables such as PAM_USER, PAM_RHOST and PAM_TYPE (pam_exec manual). This needs UsePAM yes in /etc/ssh/sshd_config, which is the setting on Debian, Ubuntu and Red Hat style systems.

1. Create the notify script

Save this as /usr/local/bin/ssh-login-notify.sh. It uses the same sendmail setup as the install guide, for example msmtp relaying through Forward Email.

#!/bin/bash
# Email a short notice when an SSH session opens. Called by pam_exec.
[ "$PAM_TYPE" = "open_session" ] || exit 0

{
  echo "Subject: SSH login: $PAM_USER on $(hostname)"
  echo "From: ssh-alerts@yourdomain.com"
  echo "To: admin@yourdomain.com"
  echo
  echo "User: $PAM_USER"
  echo "Remote host: $PAM_RHOST"
  echo "Service: $PAM_SERVICE"
  echo "Time: $(date)"
} | sendmail -t

exit 0

Make it executable by root only:

sudo chown root:root /usr/local/bin/ssh-login-notify.sh
sudo chmod 700 /usr/local/bin/ssh-login-notify.sh

2. Add the PAM line

Add this line at the end of /etc/pam.d/sshd:

session optional pam_exec.so /usr/local/bin/ssh-login-notify.sh

optional means a failed notification does not block the login. Keep your current SSH session open and test with a second login before you log out, so a mistake cannot lock you out.

3. Test it

Log in from another terminal and watch for the email. If it does not, check your MTA log (for msmtp, the logfile you set) and run the script by hand with test values:

sudo PAM_TYPE=open_session PAM_USER=test PAM_RHOST=192.0.2.1 PAM_SERVICE=sshd /usr/local/bin/ssh-login-notify.sh

Things to know about per-login alerts

• pam_exec waits for the script to finish, and sendmail through msmtp waits for the SMTP server. A slow mail server makes logins slow.
• Automation accounts that log in often (deploy users, backup jobs) will fill your inbox. Add a check such as [ "$PAM_USER" = "deploy" ] && exit 0 near the top of the script to skip them.
• The notice fires when sshd opens a PAM session, which happens for shell logins and for commands run over SSH.
• pam_exec sends the script output to /dev/null by default, so the person logging in sees nothing in their terminal.

Which alert should you use?

Most servers benefit from both: per-login notices for accounts that should rarely log in, and SSH Monitor for a summary when brute-force attempts pile up.