Alert for successful FTP login per day and per IP

[ktp]

Hello,

Is this possible to receive an alert for a successful FTP login?
The alert should be issued only once per day and per IP.
Having this feature would allow to quickly detect cases where the FTP
credentials are stolen (trojan etc...).

Also could the SSH successful login alert be issued only once per day and per IP?
This would be more useful.

Thank you.

[chirpy]

The LF_DISTFTP* options can help mitigate the attack where credentials are stolen.

[ktp]

Thank you chirpy, but it does not cover the case where the FTP credentials are stolen but used by only one IP. The alert could also inform me of any legal FTP activity.
So my initial suggestion is still valid I believe. This alert would let me know if there is any FTP activity for a given IP for each day, and I can manually check if that IP is used by an authorized person (known IP).

Could you reconsider my suggestion? Thank you.

[Thijmen]

I would like to apply this idea too to my server.

[Sergio]

You can implement your own BASH file to do this and then set a CRON to run it once a day.

Sergio