How to be Alerted via Email upon Root Access
From ReduxWiki
This simple yet very useful hack will let you know each time someone gains root shell access on your server; this is a good idea to do, as this setup can let you know very quickly if your machine has been compromised.Edit .bash_profile with your favorite editor. At the end of this file, include the following.
echo 'WARNING - Root Shell Access on:' `date` `who` | mail -s "Warning: Root Access from `who | awk '{print $6}'`"
off-site@address.tld
Make sure that the e-mail address you use is not hosted on the server, as if it was, a hacker could simply delete the email. If it's offsite, the email will be sent before the hacker is even able to gain access.
This will only work if the user that gains root launches the bash prompt.


