create /etc/ssh/login-notify.sh:
#!/bin/sh # me: rwxr-xr-x root root /etc/ssh/login-notify.sh sender="root@$(hostname)" recepient="root" [ "$PAM_TYPE" = "open_session" ] || exit 0 { echo "SSH login auf $(hostname)" echo "User: $PAM_USER" echo "Ruser: $PAM_RUSER" echo "Rhost: $PAM_RHOST" echo "Service: $PAM_SERVICE" echo "TTY: $PAM_TTY" echo "Date: $(date)" echo "Server: $(uname -a)" echo "finger:" echo "$(finger)" echo "----------------------" } | tee -a /var/log/my_logins.log | mail -r "$sender" -s "SSH login auf $(hostname)" "$recepient"
add at the end of /etc/pam.d/sshd:
session optional pam_exec.so seteuid /etc/ssh/login-notify.sh
debian 10 – still working!