What is Authentication Monitor?
If you have a Linux server running Debian or Ubuntu and want to be notified when certain users gain access to one or more of your critical services (e.g. “ssh/sshd” and “proftpd”), then Authentication Monitor might be just what you’re looking for.
Authentication Monitor runs silently in the background as a system service and monitors a user-defined list of services running on you server. Whenever a user successfully authenticates with one of these services from an unknown IP-address, you will receive an e-mail notifying you of the incident.