Script to email successful Ftp logins

Posted by admin     Category: Scripts

Shell Script to email Successful Ftp Logins.

This Shell script will search the server logs on daily basis and will email you the successful Ftp Logins of the day. The ftp logs are saved in the /var/log/messages file as by default there is no separate log file for Ftp in Linux.

Create a file /home/script/ftplogins.sh and paste the below code:

#!/bin/bash

#Retrieve the current date

CUR_DATE=`date +”%b %e”`

#Create a temporary file to store the logs
touch /tmp/out.txt

echo “List Follows” > /tmp/out.txt

#Search the successful attempts and save in the temporary file

/bin/grep “$CUR_DATE” /var/log/messages | grep pure-ftpd | grep logged >> /tmp/out.txt

#Email the contents of the file to your email address
/bin/mail -s “Successful Ftp Login Attempts on ‘$CUR_DATE’” youremail@yourdomain.com < /tmp/out.txt

Save the file. You now have to schedule a cron to execute the file once in a day to search logs. Edit the cron file

crontab -e

and add the following cron job

59 23 * * * /bin/sh /home/script/ftplogins.sh

Note:

1) This script will work with Pure-Ftpd server. You will have to edit the search string a bit according to your Ftp server.

2) If you copy/paste the script as it is in shell, the single and double quotes may change to dots (.) so make sure you correct them before executing the script.

Tags: , , , , , , , ,

13 Responses to “Script to email successful Ftp logins”

  1. LinuxHostingSupport.net » Blog Archive » Script to email … Scripts Rss Says:

    [...] post: LinuxHostingSupport.net » Blog Archive » Script to email … By admin | category: search script | tags: are-saved, daily-basis, ftp-logs, [...]

  2. imitrex Says:

    +100

  3. Even Success Says:

    Simple, but it work. Thanks.

  4. Nilesh Says:

    i did all the required things but i didn’t get below

    Note: This script will work with Pure-Ftpd server. You will have to edit the search string a bit according to your Ftp server.

    where to edit the search string a bit according to your Ftp server ?

  5. admin Says:

    If you have Pure-ftpd on your server, the script will work fine. The “Note” is just to mention that if the ftp server is different than Pure-ftpd, the search string will vary accordingly…

    I will write down the search strings for different Ftp servers i.e. proftp, vsftp etc and place the script here.

  6. Ed Says:

    Are you seeing any blank messages being sent with only the “List Follows” output in latest cPanel builds. This is on CentOS 5.5.

    Thanks

  7. admin Says:

    Hi Ed,

    CentOS 5.5 should not affect the way the script works. If you are receiving blank messages you may still be using the old script which had that problem. I have modified the script a bit with respect to “date” a week ago which should work well. BTW, are you using Pure-Ftp as your Ftp server?

  8. Ed Says:

    Pure-ftpd.

    Using the new version. Still suspect CentoOS 5.5 and cPanel as the logging picked up by Logwatch has changed also since the update.

    Thank you.

  9. Ed Says:

    Seems like the problem is here:

    https://bugzilla.redhat.com/show_bug.cgi?id=583621

  10. Ed Says:

    One other thing that would be helpful would be to exclude the localhost logins from the email results.

    Thanks

  11. admin Says:

    Hi Ed,

    I have sent you an email asking for some details. Please check it.

    And yes, if you could forward a sample log of what you mean by ‘localhost’ login, I will edit the script accordingly.

  12. admin Says:

    Hi Ed,

    Thanks for the email. Here is the text you need to add in the Search line to exclude localhost Ftp logins:

    sed ‘/127\.0\.0\.1/d’

    The Search line will now look like the following:

    /bin/grep “$CUR_DATE” /var/log/messages | grep pure-ftpd | grep logged | sed ‘/127\.0\.0\.1/d’ >> /tmp/out.txt

    Hope this helps.

  13. Ed Says:

    The sed directive does indeed work to filter out the localhost logins.

    Thank you.

Leave a Reply

*
To prove you're a person (not a spam script), type the security word shown in the picture.
Anti-spam image