To improve the security of the server, especially web server which exposes to the Internet and possible worldwide hackers, it’s best to enable server to automatically send a notification email to predefined email address every time someone logs in as root to the host. To configure the automatic email alert notification to a default email address on each incident of root log on on the server, use the following guide.
Step 1 – On Debian/Ubuntu/Linux Mint
# apt-get install mailx
Step 1 – On RHEL/CentOS/Fedora
# yum install mailx
Step 2 – Now login as root user and go to root’s home directory by typing cd /root command.
# cd /root
Step 3 – Open .bashrc file with vi or nano editor. Please remember .bashrc is a hidden file, you won’t see it by doing ls -l command. You’ve to use -a flag to see hidden files in Linux.
# vi .bashrc
Step 4 – Add the following whole line at the bottom of the file. Make sure to replace “ServerName” with a hostname of your Server and change “firstname.lastname@example.org” with a your email address.
echo 'ALERT - Root Shell Access (ServerName) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d'(' -f2 | cut -d')' -f1`" email@example.com
Step 5 – Save and close the file and logout and log back in. Once you login via SSH, a .bashrc file by default executed and sends you an email address of the root login alert.