From owner-freebsd-questions@FreeBSD.ORG Thu Feb 27 12:21:41 2014 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 64108984 for ; Thu, 27 Feb 2014 12:21:41 +0000 (UTC) Received: from mail2.nber.org (mail2.nber.org [198.71.6.79]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 1D7D61193 for ; Thu, 27 Feb 2014 12:21:40 +0000 (UTC) Received: from nber7.nber.org (nber7.nber.org [198.71.6.41]) by mail2.nber.org (8.14.7/8.14.5) with ESMTP id s1RCJJJB024974 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Thu, 27 Feb 2014 07:19:20 -0500 (EST) (envelope-from feenberg@nber.org) Date: Thu, 27 Feb 2014 07:19:16 -0500 (EST) From: Daniel Feenberg To: Arthur Chance Subject: Re: notifications of log in In-Reply-To: <530EF92E.2050004@qeng-ho.org> Message-ID: References: <530EBAEA.9050300@paz.bz> <530EF92E.2050004@qeng-ho.org> User-Agent: Alpine 2.11 (LRH 23 2013-08-11) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Anti-Virus: Kaspersky Anti-Virus for Linux Mail Server 5.6.39/RELEASE, bases: 20140227 #7318455, check: 20140227 clean X-Spam-Status: No, score=-100.0 required=5.0 tests=RP_MATCHES_RCVD, USER_IN_WHITELIST autolearn=disabled version=3.3.2 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on mail2.nber.org Cc: Jim Pazarena , FreeBSD Questions X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Feb 2014 12:21:41 -0000 On Thu, 27 Feb 2014, Arthur Chance wrote: > On 27/02/2014 04:11, Jim Pazarena wrote: >> Is there a way to have syslog email a notice upon ANY log in to a >> server, by any user ID? >> >> I'm not worried about failed attempts, but I'd like a prompt notice if >> someone does successfully log in. > 3 possibilities In order of increasing difficulty: You could put a "logger" command in /etc/csh.login and/or /etc/profile. The "login" command also seems to call at least one other command for each successful login "mail -t". I suppose you could replace "mail" with a command that detected the "-t" and both checked for mail and invoked the "logger" command to send a login info message to syslogd. PAM could also be configured to log logins. Daniel Feenberg