Welcome to Centmin Mod Community
Register Now

SSH Login Email Alerts Centmin Mod Style

Discussion in 'Centmin Mod Insights' started by eva2000, Nov 16, 2016.

  1. eva2000

    eva2000 Administrator Staff Member

    28,934
    6,567
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +9,747
    Local Time:
    3:44 PM
    Nginx 1.13.x
    MariaDB 5.5
    If you want to setup SSH login email alerts whenever you log into your Centmin Mod server. You can backup your /root/.bashrc file and then edit it using nano linux text editor as root user and add these 4 lines to very bottom of /root/.bashrc file. Make sure to change the value of your@emailaddr.com to your email address where you want to send the alerts to.
    Code (Text):
    SSH_ALERTEMAIL='your@emailaddr.com'
    SSH_ALERTIP=$(echo $SSH_CLIENT | awk '{print $1}')
    SSH_ALERTGEO=$(curl -sL ipinfo.io/$SSH_ALERTIP/geo | sed -e 's|[{}]||' -e 's/\(^"\|"\)//g' -e 's|,||')
    echo -e "ALERT: $(whoami) Shell Access $(hostname): $(date)\n$SSH_ALERTGEO" | mail -s "Alert: $(whoami) Shell Access $(hostname) from $SSH_ALERTIP" $SSH_ALERTEMAIL
    

    sample output for email subject title
    Code (Text):
    Alert: root Shell Access host.domain.com from 111.222.222.222
    

    sample output for email contents
    Code (Text):
    ALERT: root Shell Access host.domain.com: Tue Nov 15 16:31:27 UTC 2016
    
      ip: 111.222.222.222
      city: Sydney
      region: New South Wales
      country: AU
      loc: -33.9032150.9677,
      postal: 2012


    Notes:


    • If you are new to using nano linux text editor, you can read up more about nano here and here. For vim text editor read here and here.
    • You may need to whitelist the server from email address in your email inbox i.e. Gmail/Google app setup a filter for the server from email and set it to never mark as spam and add a custom label for alerts.

     
    Last edited: Nov 16, 2016
    • Like Like x 1
    • Informative Informative x 1
  2. RoldanLT

    RoldanLT Well-Known Member

    3,822
    928
    113
    May 25, 2014
    Phillipines
    Ratings:
    +1,256
    Local Time:
    1:44 PM
    1.11
    10.2
    A semi duplicate from CSF Email Notif, but this one is detailed (y).
     
    • Like Like x 1
  3. eva2000

    eva2000 Administrator Staff Member

    28,934
    6,567
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +9,747
    Local Time:
    3:44 PM
    Nginx 1.13.x
    MariaDB 5.5
    yeah hence Centmin Mod Styled = better that usual defaults :D

    edit: made a slight change to the email subject info to include hostname :)
     
    Last edited: Nov 16, 2016
  4. RoldanLT

    RoldanLT Well-Known Member

    3,822
    928
    113
    May 25, 2014
    Phillipines
    Ratings:
    +1,256
    Local Time:
    1:44 PM
    1.11
    10.2
    city and region, both blank for me?
     
  5. eva2000

    eva2000 Administrator Staff Member

    28,934
    6,567
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +9,747
    Local Time:
    3:44 PM
    Nginx 1.13.x
    MariaDB 5.5
    yeah geo data is only as accurate as the geo ip location database used so not always will show data

    you can type your ISP ip address into https://www.iplocation.net/ and see what different geo ip databases report
     
    • Like Like x 1
  6. Colin

    Colin Premium Member Premium Member

    108
    32
    28
    Oct 7, 2015
    Sheffield UK
    Ratings:
    +80
    Local Time:
    6:44 AM
    1.11.#
    MariaDB 10.1.#
    That's great. Going to confuse the heck out of people as I hit different vpn's though :)

    I think I also just passed a threshold, of whoa, centmins doing so much, I've forgotten what it's not doing :D
     
    • Like Like x 1
  7. eva2000

    eva2000 Administrator Staff Member

    28,934
    6,567
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +9,747
    Local Time:
    3:44 PM
    Nginx 1.13.x
    MariaDB 5.5
    yeah most folks won't realise how much optimisation and tweaks Centmin Mod does behind the scenes compared to non Centmin Mod setups. If a person had to manually replicate what Centmin Mod automates, you'd probably spend a good part of 4-12hrs straight even if you knew what you were doing system admin wise :D
     
    • Winner Winner x 1
  8. pamamolf

    pamamolf Well-Known Member

    2,487
    229
    63
    May 31, 2014
    Ratings:
    +390
    Local Time:
    8:44 AM
    Nginx-1.13.x
    MariaDB 10.1.x
    Why not add all info in the echo line?

    Isn't possible?
     
  9. eva2000

    eva2000 Administrator Staff Member

    28,934
    6,567
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +9,747
    Local Time:
    3:44 PM
    Nginx 1.13.x
    MariaDB 5.5
    why though, this way it's easier to expand and modify as needed
     
    • Informative Informative x 1
  10. pamamolf

    pamamolf Well-Known Member

    2,487
    229
    63
    May 31, 2014
    Ratings:
    +390
    Local Time:
    8:44 AM
    Nginx-1.13.x
    MariaDB 10.1.x
    Is there a way to get also ftp login email alerts?
     
  11. Liam W

    Liam W Member

    57
    15
    8
    Jun 26, 2014
    Barrow-in-Furness, Cumbria, England
    Ratings:
    +19
    Local Time:
    6:44 AM
    nginx/1.9.11
    10.1.11
    Bleh, I use an ssh script hooked to a pam module to send me a pushover notification... Much more secure and instant ;)
     
    • Like Like x 1
  12. eva2000

    eva2000 Administrator Staff Member

    28,934
    6,567
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +9,747
    Local Time:
    3:44 PM
    Nginx 1.13.x
    MariaDB 5.5
    nice.. you can do pushover notifications with above too just set the pushover email addy :)
    not sure, i don't think you can. I usually just stop pure-ftpd service and only start it via SSH when I need to use it :)
     
  13. RoldanLT

    RoldanLT Well-Known Member

    3,822
    928
    113
    May 25, 2014
    Phillipines
    Ratings:
    +1,256
    Local Time:
    1:44 PM
    1.11
    10.2
    Got this error after I login.
     
  14. pamamolf

    pamamolf Well-Known Member

    2,487
    229
    63
    May 31, 2014
    Ratings:
    +390
    Local Time:
    8:44 AM
    Nginx-1.13.x
    MariaDB 10.1.x
    Try to edit the:
    Code:
    /etc/postfix/main.cf
    Then add your server ip at:
    Code:
    inet_interfaces = 123.456.789.000
    or just use the option = all

    Then save and restart using:
    Code:
    service postfix restart
    Logout and login again and check :)
     
    • Like Like x 1
    • Informative Informative x 1
  15. eva2000

    eva2000 Administrator Staff Member

    28,934
    6,567
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +9,747
    Local Time:
    3:44 PM
    Nginx 1.13.x
    MariaDB 5.5
    did you disable IPv6 ? got working IPv6 ?
     
  16. RoldanLT

    RoldanLT Well-Known Member

    3,822
    928
    113
    May 25, 2014
    Phillipines
    Ratings:
    +1,256
    Local Time:
    1:44 PM
    1.11
    10.2
    Yes via custom_config so centmin disable it.
     
  17. RoldanLT

    RoldanLT Well-Known Member

    3,822
    928
    113
    May 25, 2014
    Phillipines
    Ratings:
    +1,256
    Local Time:
    1:44 PM
    1.11
    10.2
    Works great now, Many thanks!
     
    • Like Like x 2
  18. eva2000

    eva2000 Administrator Staff Member

    28,934
    6,567
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +9,747
    Local Time:
    3:44 PM
    Nginx 1.13.x
    MariaDB 5.5
    You enabled?
    Code (Text):
    DISABLE_IPVSIX='y'
    
     
  19. eva2000

    eva2000 Administrator Staff Member

    28,934
    6,567
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +9,747
    Local Time:
    3:44 PM
    Nginx 1.13.x
    MariaDB 5.5
    @RoldanLT if you edit /etc/hosts

    find
    Code (Text):
    ::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
    

    comment it out with hash in front
    Code (Text):
    #::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
    

    and set inet_interfaces = localhost again and restart postfix, does it work ?

    or more proper way try setting postfix variable
    Code (Text):
    inet_protocols = all
    

    to
    Code (Text):
    inet_protocols = ipv4
    

    restart postfix
     
  20. RoldanLT

    RoldanLT Well-Known Member

    3,822
    928
    113
    May 25, 2014
    Phillipines
    Ratings:
    +1,256
    Local Time:
    1:44 PM
    1.11
    10.2
    Yes Eva.