Email alert when logged on the webgui?

[killmasta93]

Hi,
I was wondering if someone could assist me on what im trying to do. Im trying to get email alert every time when i or someone logs in the webgui of proxmox i got working email alert when someone SSH

IP="$(echo $SSH_CONNECTION | cut -d " " -f 1)"
HOSTNAME=$(hostname)
NOW=$(date +"%e %b %Y, %a %r")

echo 'Someone from '$IP' logged into '$HOSTNAME' on '$NOW'.' | mail -s 'SSH Login Notification' email@mydomain.com

any ideas?

Thank you

 

[oguz]

For incoming SSH logins you can check the file '/var/log/auth.log', in which you can grep for accepted/failed authentications and send the new entries as an email.

 

[killmasta93]

Thanks for the reply. for ssh logins thats correct but for WebGUI no it seems to appear in /var/log/syslog

Jan 10 11:28:33 prometheus pvedaemon[1669]: <root@pam> successful auth for user 'root@pam'

 

[killmasta93]

So i have somewhat have something but not sure if will do any help would be greatly appreciated

#!/bin/bash
VARIABLE=<root@pam> successful auth for user 'root@pam'
cat /var/log/syslog | sed $VARIABLE'q;d

when i run it im getting this error

root@prometheus:~# ./find
./find: line 2: root@pam: No such file or directory
Jan 10 06:25:11 prometheus systemd[1]: Started Proxmox VE firewall logger.

It finds the code but not sure how i can implement it when someone logs in and then emails maybe a cron job every minute?

 

[t.lamprecht]

We have an access log for all API related requests in /var/log/pveproxy/access.log (and rotated versions). So you could do:

grep 'access/ticket' /var/log/pveproxy/access.log

you see the IP from where the login try happened, and if it succeeded the status code "200" will be the next-to-last number. If you want the user name too you could then check for the next request from this IP with a valid username (third argument in a log line).

 

[killmasta93]

Thanks for the reply so this is what i got so far

grep 'extjs/version?' /var/log/pveproxy/access.log | tail -1 |  mail -r "<email@mydomain.com>" email@mydomain.com -s "Login of proxmox "

That line tells me the user, IP and the date which is great then emails me with the subject. Now all i need is how i can automatically get the alerts?

 

[t.lamprecht]

One way to do it would be using "tail -F" stream it into grep and tell it to use line buffered mode, i.e., something like:

tail -F /var/log/pveproxy/access.log | grep --line-buffered ...

the uppercase -F handles rotates of the file and line buffered ensures that grep directly output matches.

(but note that those checks also count a reload of a logged in user as "new log in", just FYI).