Monit: email alerting on an SSH logins
Tags: monitoring, linux, ssh, security
Published: 2019-03-23 18:39:44

---
title: Monit: email alerting on an SSH logins
published: true
tags: Monitoring,Linux,SSH,security
canonical_url: https://rtfm.co.ua/en/monit-email-alerting-on-an-ssh-logins/
---

![](https://rtfm.co.ua/wp-content/uploads/2017/08/monit_logo-1.png)The task is to send an email alert when SSH-login was made from an IP which is now whitelisted.

Will use Monit here.

Install it:

```
root@jenkins-dev:/home/admin# apt update && apt -y install monit
```

Configure email settings: set _localhost_ (we have a local `exim` here), email’s format and email’s receiver.

Edit the `/etc/monit/monitrc` file:

```
...
set mailserver localhost

set mail-format {
  from:    Monit <monit@$HOST>
  subject: monit alert --  $EVENT $SERVICE
  message: $EVENT Service $SERVICE
                Date:        $DATE
                Action:      $ACTION
                Host:        $HOST
                Description: $DESCRIPTION
           
           Your faithful employee,
           Monit
}

set alert user@example.com
```

Now add the rules file `/etc/monit/conf.d/ssh_alerts.conf`:

```
check file ssh_logins with path /var/log/auth.log
  ignore match "/etc/monit/whitelist_ips.txt"
  if match "Accepted publickey" then alert
```

Check the documentation about `IGNORE` [here>>>](https://mmonit.com/monit/documentation/monit.html#FILE-CONTENT-TEST) and about email’s formatting – [here>>>](https://mmonit.com/monit/documentation/monit.html#Message-format).

If instead of key-based authorization password-based is used – change “_Accepted publickey_” to “_Accepted password_“.

Now in the `/etc/monit/whitelist_ips.txt` file add the _1.1.1.1_ IP – after testing will set a real one(s):

Restart the `monit`service:

```
root@jenkins-dev:/home/admin# systemctl restart monit
```

Check how it’s working – login to a server:

```
12:50:21 [setevoy@setevoy-arch-work ~]  $ sshjenkinsdev
...
admin@jenkins-dev:~$
```

Check Monit’s logs:

```
root@jenkins-dev:/home/admin# tail -f /var/log/monit.log
Stored in '/var/lib/monit/id'
[EET Mar 15 12:32:11] info     : Starting Monit 5.20.0 daemon
[EET Mar 15 12:32:11] info     : 'jenkins-dev' Monit 5.20.0 started
[EET Mar 15 12:39:37] info     : Monit daemon with pid [5074] stopped
[EET Mar 15 12:39:37] info     : 'jenkins-dev' Monit 5.20.0 stopped
[EET Mar 15 12:40:28] info     : Starting Monit 5.20.0 daemon
[EET Mar 15 12:40:28] info     : 'jenkins-dev' Monit 5.20.0 started
[EET Mar 15 12:50:28] error    : 'ssh_logins' content match:
Mar 15 12:50:25 localhost sshd[5262]: Accepted publickey for admin from 194.***.***.26 port 33586 ssh2
[EET Mar 15 12:52:28] info     : 'ssh_logins' content doesn't match
```

And an email:

[![](https://rtfm.co.ua/wp-content/uploads/2019/03/Screenshot_20190315_125203.png)](https://rtfm.co.ua/wp-content/uploads/2019/03/Screenshot_20190315_125203.png) 

Obviously – such an approach may be used for anything just by changing the `if match` conditions.

For example – I have one site which is inaccessible for all excluding myself, so I added another rule:

```
check file nginx_web_access with path /var/log/nginx/example.com-access.log
  ignore match "/etc/monit/whitelist_ips.txt"
  if match "GET" then alert
```

Here on any `GET`-request from an IP not added to the white list – I’ll get an email alert.

The `/etc/monit/whitelist_ips.txt` may look like next:

```
setevoy@rtfm-do-production:~$ cat /etc/monit/whitelist_ips.txt
194.***.***.26
188.***.***.48
```

Here is one IP of my job’s network and another one – my home.

Done.

### Similar posts
 
- <small>03/06/2019</small> [Prometheus: blackbox-exporter probe_http_status_code == 0 and its debug](https://dev.to/setevoy/prometheus-blackbox-exporter-probehttpstatuscode--0-and-its-debug-41mc)<small> (0)</small>  
- <small>03/10/2019</small> [Prometheus: RTFM blog monitoring set up with Ansible – Grafana, Loki, and promtail](https://dev.to/setevoy/prometheus-rtfm-blog-monitoring-set-up-with-ansible--grafana-loki-and-promtail-58i)<small> (0)</small>  
- <small>02/07/2019</small> [Grafana Labs: Loki – distributed system, labels and filters](https://rtfm.co.ua/en/grafana-labs-loki-distributed-system-labels-and-filters/)<small> (0)</small>  
- <small>06/11/2018</small> [Prometheus: AWS EC2 service discovery](https://rtfm.co.ua/prometheus-aws-ec2-service-discovery/)<small> (0)</small>