Add this to .bashrc of user. When user logs in (via ssh or console), you receive an e-mail at ${DEST_EMAIL}

alert_user_login.sh

### add this to .bashrc
DEST_EMAIL="[email protected]"
TMPCOOKIE="/tmp/cookie.$(date +%y%m%d%H%M%S)"
CONNIP=$(echo $SSH_CONNECTION | cut -d " " -f 1)
touch ${TMPCOOKIE}
if [ -z "$CONNIP" ]
then
        echo "${HOSTNAME}: User $USER just logged in from console" >> ${TMPCOOKIE}
        echo >> ${TMPCOOKIE}
        w >> ${TMPCOOKIE}
        mail -s "ssh login at ${HOSTNAME}" ${DEST_EMAIL} < ${TMPCOOKIE}
        rm -f ${TMPCOOKIE}
else
        echo "${HOSTNAME}: User $USER just logged in from $CONNIP" >> ${TMPCOOKIE}
        echo >> ${TMPCOOKIE}
        w >> ${TMPCOOKIE}
        mail -s "ssh login at ${HOSTNAME}" ${DEST_EMAIL} < ${TMPCOOKIE}
        rm -f ${TMPCOOKIE}
fi