Root user ssh login mail alert.


echo 'ALERT- Root Access on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d"(" -f2 | cut -d")" -f1`" admin@domain.com

or

echo 'ALERT- Root Access on:' `date` `who` | mail -s "Alert: Root Access from `who --i|grep root`" admin@your-domain.com


Additional SSH Security

1. Scroll down the SSH server configuration file and locate a line like below:

#PermitRootLogin yes

2. Uncomment the line by removing the hash symbol (#), and then change the “yes” to “no”. The final line should look like below:

PermitRootLogin no