het bestand /etc/bashrc word bij elke login uitgevoerd.
je zet onderaan een linkje naar een script, of zelf direct een script. ik zelf heb een mailer geschreven die elke login logged en mailt naar een aparte mailbox, zodat de sporen niet meer uit te wissen zijn.. mocht het fout gaan

hier isset script.
#! /usr/bin/perl -w
$user_info = `/usr/bin/who am i`;
($server, $term, $month, $day, $time, $dns) = split (" ", $user_info);
($server, $username) = split ("!", $server);
$username = `echo \$USER`;
chomp($username);
$dns =~ s/\)//;
$dns =~ s/\(//;
@host_info = split (" ", `/usr/bin/host $dns`);
$logfile = "/var/log/login/logins.$month.$day.log";
open (LOG, ">>$logfile") or die "Could not write logfile";
print LOG "$dns ($host_info[3]) Logged in on $term as $username at $month $day $time\n";
close LOG;
chmod 0666, $logfile;
use Net::SMTP;
my $ServerName = "127.0.0.1";
$smtp = Net::SMTP->new($ServerName, Debug => 0);
die "Couldn't connect to server" unless $smtp;
my $MailFrom = "LoginWatcher\@iziforum.com";
my $MailTo = "johan\@iziforum.com";
$smtp->mail( $MailFrom );
$smtp->to( $MailTo );
$smtp->data();
$smtp->datasend("To: $MailTo\n");
$smtp->datasend("From: $MailFrom\n");
$smtp->datasend("Subject: $username Logged in at $month $day $time\n");
$smtp->datasend("\n");
$smtp->datasend("LoginWatcher report:
User logged in on: $server
User logged is as: $username
User using terminal: $term
Cussent date is: $month $day $time
User is coming from: $dns ($host_info[3])
");
$smtp->dataend();
$smtp->quit();
print "\n
You are logged in on: $server
You are logged is as: $username
You are using terminal: $term
Current date is: $month $day $time
Your coming from: $dns ($host_info[3])
Your information is logged and E-mailed to the administrator.
Have a nice day and welcome to the Webserver.\n";
die pleur je ergens neer en in je /etc/bashrc laat je hem uitvoeren..