Server Sends Email Alert on Root Login
Edit /root/.bash_profileecho 'Root Shell Access on:' date who | mail -s "Alert: Root Access from who | cut -d"(" -f2 | cut -d")" -f1" [email protected] every root login you will receive something like this ALERT - Root Shell Access on: Wed JUL 7 09:30:10 2016 root pts/0 Jul 7 09:30 (109.177.xxx.xx)