Failed logins (hacks?): how can i send an email, if this happens?

Hi everybody,

via a script in /etc/hotplug.d/dhcp it is possible to send an email, when someone got a dhcp-lease.

Fine :slight_smile:

Is it possible (via a similar mechanism) to notify/send mail, if a connect fails
(maybe because of wrong pass/etc) ?

Best regards
Harry

sure!

this kind of script How to reboot router when a string appears in the log - #14 by yousong

then set up postfix and send the messages using mailsend, there might be a sender included in postfix too, but I'm not sure.
Mailsend could be all you need, and skip postfix completely.

Since sending emails via your provider can be tricky, some block outgoing SMPT traffic, I actually use a service called Pushed for sending messages to an app, implementation is fairly simple - you just call an URL using curl.

curl -X POST -s --form-string "app_key=234234wdffsdfsdfsf" --form-string "app_secret=lsjflsjdfof790wr78lsjdfs7dfsldfjsdfr34" --form-string "target_type=channel" --form-string "target_alias=ZZZZZZZ" --form-string "content=my message text here" https://api.pushed.co/1/push

there are other web services providing the same solution, but this was fairly easy to set up, and
had less restrictions to amount of free messages sent on a monthly basis.

Hi,

thanks for the message.

The real problem is, how the system triggers "there's a failed connect".

Which means: where is the hook to be informed that there' an event ?

Best regards

as in the linked post, logread -f.

then try to connect, make it fail, and adjust the search signature accordingly.

problem is there might be several error messages, for a failed logon, so you'll have to watch the log,
or trigger on everything, but successful logons.