监控服务器ssh登录事件发送通知邮件

1、登录要进行ssh登录监控的服务器,在/etc/ssh创建"sshrc"文件

#!/bin/bash
#获取登录者的用户名
user=$USER
#获取登录者的IP地址
ip=${SSH_CLIENT%% *}
#获取登录的时间
time=$(date +%F%t%k:%M)
#服务器的IP地址
hostname=$(hostname)
echo "content=$time,$user,$ip,$hostname" > log

python /etc/ssh/Email.py   "$time" "$user" "$ip" "$hostname"

2、并在如上自定义路径中创建“Email.py”文件

#!/usr/bin/python
# -*- coding: UTF-8 -*-

import smtplib
from email import encoders
from email.header import Header
from email.mime.text import MIMEText
from email.utils import parseaddr, formataddr
import sys
def send_mail(dtime,duser,dip,dhostname):
    #基础信息
    # from_addr = input("From:")
    from_addr = "service@ponfey.com"
    password = "%6rL2fQlFUKSbzP0" #授权码
    #to_addr = from_addr
    to_addr = "xiaoshuai.zhu@ponfey.com"
    # password = raw_input("Password:")
    # to_addr = input("To:")

    def _format_addr(s):
            name, addr = parseaddr(s)
            return formataddr((Header(name, 'utf-8').encode(), addr))

    smtp_server = "smtp.ponfey.com"
        mimetex = '您的设备:',dhostname,',于:',dtime,',被IP:',dip,'以账号',duser,'进行登录,请确认是否为本人或管理员操作。'
    #构造邮件
    msg = MIMEText(''.join(mimetex), 'plain', 'utf-8')
    msg['From'] = _format_addr("service@ponfey.com")
    msg['To'] = _format_addr("xiaoshuai.zhu@ponfey.com")
    msg['Subject'] = Header("来自登陆日志服务", 'utf-8').encode()
    #发送邮件
    server = smtplib.SMTP_SSL(smtp_server, 465)
    server.set_debuglevel(1)
    server.login(from_addr, password)
    server.sendmail(from_addr, [to_addr], msg.as_string())
    server.quit()

if __name__ == "__main__":
    send_mail(sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4])
上一篇
下一篇