Differentiating between login and logout under pam_exec and session

[Drew Leske <dleske uvic ca>]

Hi all,

I would like to have some machines page me on logins.  It seems to me (with limited PAM understanding and experience) that the most appropriate place for this is using the following line in system-auth:

session required pam_exec.so (script-name)

The script sends an e-mail using environment variables set by pam_exec to let me know that a given user has logged in to which box from where, for what service.  The only problem is it sends this on both logins and logouts and I can't see how to differentiate.  I would like it to either not let me know about logouts, or preferably, for the script to simply tell me "Bob logged in to service sshd from wherever.example.com" or "Bob logged out from ..."  I have had my script log all environment variables passed to it and they seem to be identical in both login/logout scenarios.

Any ideas?  Is this an appopriate use of session, pam, ...?  I know I could add stuff to login scripts or make a monitor for syslog, but this seems to me to be the best place to put this sort of thing.

Thanks everybody
Drew.




Drew Leske, Unix Services Team, CASS, University of Victoria.
   mel: dleske uvic ca
   tel: 250-472-5055
   cel: 250-588-4311