Re: [sshd] send a mail when a event login occur ?

"Barton L. Phillips" typed:
Carlos Moreno wrote:
Ertugrul Soeylemez wrote:

The actual problem with this "mail bombing" is that you would
reveal all user names by this method, unless you send
signed/encrypted mails. If you need to see that remotely, then
you're better of tail-ing the log file for your SSHd over an own
SSH session, e.g.:

# tail -f /var/log/auth.log

But another problem with this is that if the bad guys succeed in
breaking into the machine through SSH, they could tamper with the
log files.

The idea of sending an e-mail sounded to me like the OP wants to
get around the possibility of log-tampering (there is no way that
the intruder will have time o tamper with the system in time to
prevent the e-mail from leaving the machine ... Of course, unless
the e-mail is sent to an address that is received by a sendmail
running on the same machine!!! :-) )

Why not just remote log? Email could end up creating a lot of
traffic.

My sentiments exactly. Setting up syslog or syslog-ng to send logs to
a remote logging server is a much better approach.

--
Ayaz Ahmed Khan

Say something you'll be sorry for, I love receiving apologies.

.

Relevant Pages

  • Re: IIS Hangs; IISState Log in this message
    ... >> running from the web server, and our site also utilizes MS Outlook web ... >> I have included the full content of the IISState log file below. ... >> CSDunn ... >> Remote call is either to a MTA object or object not initialized. ...
    (microsoft.public.inetserver.iis)
  • Re: Visual Editor problem in Eclipse 3.2
    ... See .log file for trace of ... !MESSAGE IWAV0138E Remote VM terminated too soon. ... trace of output. ... I think you will get a quicker response by asking in the correct newsgroup. ...
    (comp.lang.java.softwaretools)
  • Re: managment software for FTP server.
    ... like the log file. ... But in real time and with graphic interface. ... that's one part ftp server can provide. ... > remote desktop, vnc, pcanywhere, TS and etc. ...
    (microsoft.public.inetserver.iis.ftp)
  • Reg RAS Security
    ... I am using windows2000 server RAS for employee to connect while they are ... in Remote place to access the Corporate network. ... In the Log file i can't able ...
    (microsoft.public.access.security)
  • Re: [sshd] send a mail when a event login occur ?
    ... Setting up syslog or syslog-ng to send logs to ... a remote logging server is a much better approach. ...
    (comp.os.linux.security)