我做了什么：
创build一个login-notify.sh文件（用户root，组root，chmod 755）并将其放在/etc/ssh/
#!/bin/sh if [ "$PAM_TYPE" != "close_session" ]; then # assembling my variable $TEXT ... echo $TEXT | mail -r "root@.... " - s "Subject line" root
修改/etc/pam.d/sshd ：
echo "session required pam_exec.so seteuid /etc/ssh/login-notify.sh" | sudo tee -a /etc/pam.d/sshd
重新启动sshd服务器，甚至重新启动机器
手动启动/etc/ssh/login-notify.sh – >邮件成功发送
通过sshlogin – >没有发送邮件
添加步骤/信息
从命令行发送电子邮件我使用ssmtp和一个Gmail帐户
而不是发送邮件我试图追加一个string到文件，看看它是否工作（回声“SSHlogin> /家庭/用户/ sshtesting） – >没有运气…
服务器只接受ssh-logins的公共/密钥authentication
/var/log/syslog没有提供有用的信息：
Dec 27 14:20:51 srv1 fwknopd[2155]: Removed rule 1 from FWKNOP_INPUT with expire time of 1419686451 Dec 27 14:41:48 srv1 fwknopd[2155]: (stanza #1) SPA Packet from IP: xxx.xxx.xxx.xxx received with Access source match Dec 27 14:41:48 srv1 fwknopd[2155]: [xxx.xxx.xxx.xxx] (stanza #1) Incoming SPA data signed by 'XXXXXX'. Dec 27 14:41:48 srv1 fwknopd[2155]: Added Rule to FWKNOP_INPUT for xxx.xxx.xxx.xxx, tcp/xxx expires at 1419687738
在这一行后，我通过SSHlogin…没有额外的文字写入/var/log/syslog
hm，根据你的问题主题行，安装csf防火墙或者OSSEC，内置你需要的function。
CSF防火墙：
lfd on cluster-master-acl: SSH login alert for user root from 86.234.45.45 (IE/Ireland/cm-86.234.45.045.ntlworld.ie) Time: Fri Dec 26 13:59:51 2014 +0000 IP: 86.234.45.45 (IE/Ireland/cm-86.234.45.045.ntlworld.ie) Account: root Method: publickey authentication
。
lfd on web1: SU login alert - Successful login from admin(uid=0) to root Time: Sat Dec 27 11:45:26 2014 -0500 From: admin(uid=0) To: root Status: Successful login
OSSEC：
OSSEC HIDS Notification. 2014 Dec 28 10:58:53 Received From: (web-node-3) 138.71.183.65->/var/log/secure Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." Portion of the log(s): Dec 28 05:58:49 ID13412 sudo: pam_unix(sudo:auth): conversation failed
等等，其实你可以修改警报，就像你需要它们一样。
不要太复杂。 您可以使用仅限邮件的操作来设置fail2ban ，以便在尝试失败时通知您。