Question Email notification when user logs in to Plesk

[camthor]

Server operating system version

Debian 10.13

Plesk version and microupdate number

18.0.61_build1800240703.08

I want to set up notifications for any user login (including admin/root) to Plesk using this information: Question - Plesk email alert login

So I created an event "Plesk user logged in" with the command

echo "username: ${NEW_CONTACT_NAME}" | mail -s "Plesk: User login" -r "[email protected]" [email protected]

. Priority lowest, user "root".

It works when I run this command with SSH, but no email arrives when I log out and log back in to Plesk. Do I have to enable events somewhere?

 

[Kaspar@Plesk]

Hi there, did you use that command directly in the in the command field of the event? If so, I recommend creating a Bash script instead with that command and calling that script from the command field of the event instead.

There is a similar topic here that might help you troubleshoot.

 

[camthor]

Thank you! Indeed, it works now after I moved that line into a bash script and call that script in the event.

 

[mrqwerty1980]

Hi, Is there any way to also put the IP address of the login to the mail body like:

echo "username: ${NEW_CONTACT_NAME}" | mail -s "User Login Plesk Panel" -b "$plesk db "SELECT login,ip_address FROM sessions;"" [email protected]

 

[Kaspar@Plesk]

Hi, Is there any way to also put the IP address of the login to the mail body like:

Unfortunately not. Because the session gets created after the event has fired. Meaning there is no IP to fetch from the database yet up on firing this event.

 

[mrqwerty1980]

Create an event "Plesk user logged in" to run the following script inside /usr/local/psa/bin/login.sh and set this to run on login. This will include the username and ip of the preson who logs in. Make sure you chmod it to +x as I know plenty who forget to do this lol.

#!/bin/bash

EMAIL="YOUR_EMAIL_ADDRESS"
HOSTNAME=$(hostname)
STATE_FILE="/var/log/plesk-last-login.txt"

# Wait a second to ensure Action Log is written
sleep 1

# Extract the latest successful login
LAST_LOGIN=$(plesk bin action-log --show -since $(date +%F) -json \
| jq -r 'select(.action_name=="cp_user_login") | "\(.date) \(.ip_address) \(.user)"' \
| tail -1)

# Parse fields
DATE=$(echo "$LAST_LOGIN" | awk '{print $1" "$2}')
IP=$(echo "$LAST_LOGIN" | awk '{print $3}')
USER=$(echo "$LAST_LOGIN" | awk '{print $4}')

# Check if we already sent an alert for this login
if [[ -f "$STATE_FILE" && "$(cat $STATE_FILE)" == "$LAST_LOGIN" ]]; then
exit 0 # Already sent, do nothing
fi

# Save the last login to state file
echo "$LAST_LOGIN" > "$STATE_FILE"

# Optional: reverse DNS
RDNS=$(host "$IP" 2>/dev/null | awk '{print $5}')

# Compose the email
MESSAGE="
Plesk Login Alert
Server: $HOSTNAME
User: $USER
IP: $IP
Reverse DNS: ${RDNS:-N/A}
Time: $DATE
"

# Send the email
echo "$MESSAGE" | mail -s "Plesk Login Alert on $HOSTNAME" "$EMAIL"
rm -f "$STATE_FILE"