Re: Get email alerts on SSH login
I'm not sure exactly what the goal is here.
All sshd logins are logged in /var/log/secure, so the logs for his file could be redirected to a tcp connection which could be something as simple as a netcat command.
The pam_exec module can send emails or do most anything else.
The sshd ForceCommand feature replaces the login shell or the command - so it i not particularly useful.
But if the problem is that you are worried that someone has cracked system - then you should reconfigure sshd to avoid that possibility. Configure the sshd authentications to require keys (disable passwords) then install a key and be careful with the private half & any passphrase.
None are more hopelessly enslaved than those who falsely believe they are free.
Johann Wolfgang von Goethe