where's the SSHD log? I want to see who's been logging in via ssh.

Hi Michael,

Logging

Recording events through system logging and reviewing these logs is a key element of good security. Good logging provides information as to what happened, when it happened, and (usually) who did it. By default, Mac OS X logs a fair bit of information to several files in the /var/log directory. One of these is system.log, which records general information from various subsystems. Examples of the types of events recorded in the logs are:

* Firewall (ipfw) blocked packets.
* Web server access and error messages.
* Use of privilege escalation tools.
* Informational messages, such as subsystem status messages.

http://developer.apple.com/internet/security/securityintro.html

Have you opened Console in Utilities & had a look around?

There is no SSH log, per se.

Login attempts are logged in two separate places.

First it's logged in /var/log/asl.db but you can't read this file directly. You can use last, though, which decodes this file to show recent logins.

In addition logins are logged in /var/log/system.log. Look for lines that include the string 'sshd', e.g.:

grep sshd /var/log/system.log

Or use /Applications/Utilities/Console.app to view the logs if you're more comfortable there.

Michael Levin wrote:

First it's logged in /var/log/asl.db but you can't read this file directly. You can use last, though, which decodes this file to show recent logins.

I have no /var/log/asl.db but I do have a /var/log/asl.log - is that normal?

I have /var/log/asl.log, but not asl.db. I wonder if Camelot's looking at his Leopard system, which I believe might be different. My asl.log file is human readable, though it's not the same format as most other log files.

not a single instance from that grep. Is that normal?

In Tiger, SSH logins aren't logged in system.log by default, so yeah, it's normal. They are logged in /var/log/secure.log, though. It's owned by root, so you'll have to use sudo:

<pre class="command">sudo grep ssh /var/log/secure.log</pre>

To look at the older, gzipped secure log files, you'll need to unzip them first in the Terminal, since the Console app won't have permission...

charlie

I have no /var/log/asl.db but I do have a /var/log/asl.log - is that normal?

Oh, yes... you're on Tiger. This was changed in Leopard to be a binary file rather than a plain text log.

It also explains the system.log vs. secure.log difference - Tiger vs. Leopard.