sudo apt update && sudo apt install mailutils postfix -y

sudo nano /etc/postfix/main.cf

relayhost = [smtp.gmail.com]:587
smtp_use_tls = yes
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

sudo nano /etc/postfix/sasl_passwd

[smtp.gmail.com]:587 yourgmail@gmail.com:your_app_password

sudo postmap /etc/postfix/sasl_passwd
sudo chmod 600 /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db
sudo systemctl restart postfix

echo "Test Email from Server" | mail -s "Test Email" yourgmail@gmail.com

sudo nano /usr/local/bin/login-notify.sh

#!/bin/bash
IP=$(echo $SSH_CONNECTION | awk '{print $1}')
HOST=$(hostname)
USER=$(whoami)
DATE=$(date)

echo -e "✅ SSH Login Alert:\nUser: $USER\nIP: $IP\nDate: $DATE\nHost: $HOST" \
| mail -s "🔐 SSH Login to $HOST" yourgmail@gmail.com

sudo chmod +x /usr/local/bin/login-notify.sh

sudo nano /etc/pam.d/sshd

session optional pam_exec.so /usr/local/bin/login-notify.sh

sudo systemctl restart ssh

sudo nano /usr/local/bin/failed-login-alert.sh

#!/bin/bash
EMAIL="yourgmail@gmail.com"
LOGFILE="/var/log/auth.log"
LAST=$(tail -n 10 $LOGFILE | grep "Failed password")

if [[ ! -z "$LAST" ]]; then
    echo -e "❌ SSH Failed Login Attempt:\n\n$LAST" | mail -s "🚨 SSH Failed Login Detected" $EMAIL
fi

sudo chmod +x /usr/local/bin/failed-login-alert.sh

sudo crontab -e

*/2 * * * * /usr/local/bin/failed-login-alert.sh

sudo ufw logging on

sudo nano /usr/local/bin/firewall-alert.sh

#!/bin/bash
EMAIL="yourgmail@gmail.com"
LOGFILE="/var/log/ufw.log"
ALERT=$(tail -n 20 $LOGFILE | grep "BLOCK")

if [[ ! -z "$ALERT" ]]; then
    echo -e "🔥 UFW Firewall Blocked Traffic:\n\n$ALERT" | mail -s "🔥 UFW Alert from $(hostname)" $EMAIL
fi

sudo chmod +x /usr/local/bin/firewall-alert.sh

sudo crontab -e

*/5 * * * * /usr/local/bin/firewall-alert.sh

sudo nano /usr/local/bin/ssh-weekly-report.sh

#!/bin/bash
EMAIL="yourgmail@gmail.com"
HOST=$(hostname)
SUCCESS=$(grep "Accepted password" /var/log/auth.log | wc -l)
FAILED=$(grep "Failed password" /var/log/auth.log | wc -l)
TOP_IPS=$(grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr | head -5)

echo -e "📊 Weekly SSH Summary ($HOST)\n\n✅ Success: $SUCCESS\n❌ Failed: $FAILED\n\nTop Failed IPs:\n$TOP_IPS" \
| mail -s "📈 Weekly Report - $HOST" $EMAIL

sudo chmod +x /usr/local/bin/ssh-weekly-report.sh

sudo crontab -e

0 7 * * 1 /usr/local/bin/ssh-weekly-report.sh