Scenario
One of my customers has some Debian based boxes directly accessible on the Internet with no firewalling on the ssh port. Those boxes are configured for an "instant" mail notification when a remote ssh user succesfully logs in:
me@server:~$ sudo cat /etc/ssh/sshrc
ip=`echo $SSH_CONNECTION | cut -d " " -f 1`
logger -t ssh-wrapper $USER login from $ip
echo "User $USER just logged in to $(hostname) from $ip" | mail -s "SSH Login" -- security@customer.dom &
I was wondering if this can actually be considered a (good) security notification, as the user who logs in is executing this command, and thus a malicious user might have control over such an event. It obviously happens milliseconds after login, so it should be very hard for an attacker to catch it, but I'm still not sure that a remote user can't circumvent this server side global sshrc.
For instance, I've been working for them for months and didn't even noticed it, but they received such a notification each time I logged in. They pointed my attention on it, because they said they changed something in one of their scripts, that is now generating much more connections than before, and thus they asked me to prevent this user from generating the notification in order to prevent the mailbox to be flooded.
As I'm an instinctive guy, I promptly added an if to match the user that shouldn't generate the notification, and that did the trick, but I think that this makes this measure even weaker than what it already looked like.
I don't know if it's possible, I tried many different searches that didn't returned anything relevant, but if a user on the client side may be able to specify a different path for the sshrc, for instance, this measure would miserably fail. If the MTA has a full queue and the user is able to elevate it might easily dequeue/delay the mail, that's why I'd swap the mail with an SMS service at least.
That's just some of my doubts, and that's why I'm planning to talk to the customer's CIO about this weakness, and would like to have your opinion about that. Of course, he will ask me "what do you think a most secure and still free solution would be?" Cash is always The King.
Honestly I have not yet an answer for such question, but I think that if they want to keep this "logic", at least, root should watch the log and notify when each user logs in. No every minute crontab as they want such notifications to be instant. So I think I might script something with fileschanged and tail, and either use SMS or keep the mail as the customer prefers. That would be executed by root and thus won't be under the user's control.
Questions
-Is it possible for a remote unprivileged user to disable server's sshrc client-side?
-The customer wants to keep this kind of notification, so good or bad, do you consider this way to get it a good way?
-Is there any other free way to be promptly notified on an ssh login, in a non circumventable manner?
-Don't you think it would be more secure switching from email to SMS?
