get notified instantly when someone logs into your server as root

It’s best to use an email address not hosted on the server your sending the alert from.

1. Login into your server via ssh and su to root (or log in as root – not advisable)

2. cd /root

next edit .bashrc with your preferred editor, Im going to use vi

3. vi .bashrc

4. add the following to the end of your file:
echo ‘ALERT – Root Shell Access (YourserverName) on:’ `date` `who` | mail -s “Alert: Root Access from `who | cut -d”(” -f2 | cut -d”)” -f1`” you@yourdomain.com

next save the file, Im using vi so

5. press escape, type colon, and ‘wq’, followed by return

6. Logout of SSH, close the connection and log back in.

You should receive an email address of the root login alert.