Send email when anyone logs on
You should use a solucion for log monitoring like OSSEC, it will look on your logs for security information (including login, sudo, etc.) and send you an e-mail when the alert is important.
It's easy to configure and you can raise the alert level for e-mails or include an alert-by-email
on the specific alert.
It can also do configurable active-response, blocking IPs and denying access for a period of time by default.
you could put this in your .bashrc
echo 'ALERT - Root Shell Access to' $(hostname) 'on:' `date` `who` \
| mail -s "Alert: Root Access from `who | cut -d"(" -f2 | cut -d")" -f1`" YOUREMAIL
Slight change of adams solution which doesn't break if root is logged into more than one terminals:
login_info="$(who | head -n1 | cut -d'(' -f2 | cut -d')' -f1)"
message="$(
printf "ALERT - Root Shell Access (%s) on:\n" "$(hostname)"
date
echo
who
)"
mail -s "Alert: Root Access from ${login_info}" admin <<< "${message}"