Open the “bash_profile”
vi ~/.bash_profile
Add the following content and replace the ” youremailaccount@yourdomain.com” with your email account that you wish to recieve email alerts.
# Email admin when user logs in as root
rootalert() {
echo 'ALERT - Root Shell Login'
echo
echo 'Server: '`hostname`
echo 'Time: '`date`
echo 'User: '`who | awk '{ print $1 }'`
echo 'TTY: '`who | awk '{ print $2 }'`
echo 'Source: '`who | awk '{ print $6 }' | /bin/cut -d '(' -f 2 | /bin/cut -d ')' -f 1`
echo
echo
echo 'This email is an alert automatically created by your server telling you that someone, even if it is you, logged into SSH as the root user. If you or someone you know and trust logged in as root, disregard this email. If you or someone you know and trust did not login to the server as root, then you may have a hack attempt in progress on your server.'
}
rootalert | mail -s "Alert: Root Login [`hostname`]" youremailaccount@yourdomain.com