Its very important to keep a check on your servers and who logs into the server, From security point of view its very important to keep track specially for root user login, As server owner or administrator you will be the only person having root access for your server and nobody else should be permitted to login into the server with root user unless you have specifically given access to. So with the help of this small one line script given below you can always keep a watch on root login attempts.
Setup Method
1.) Login into the server as root user.
2.) Change the path to /root i.e cd /root
3.) Edit the .bashrc file i.e vi .bashrc
4.) Paste the following code at the bottom -
echo 'ALERT - Root Shell Access (hostname) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d'(' -f2 | cut -d')' -f1`" your@yourdomain.com
5.) Remember to change the hostname and email address in the code.
6.) Save and close the file, Logout and login again with root user to check if you receive the email alert.
7.) If you haven't received any email then mail function is not working. Consult your webmaster.
