Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to enable SSH on my Mac, but I want to be notified when someone tries to log in.

I'm running on a non-default port, so attempts should be rare.

I'm currently running a growl notification in .profile, but I'm not sure that is fool-proof, and I'd rather have email.

lgn=`who | grep "("`
if [ -n "$lgn" ]; then
    growlnotify login -m $lgn
share|improve this question

This answer is specific to Mountain Lion (10.8):

At a general level, instead of using the who command, you could have a daemon monitor /var/log/system.log.

Specifically, look for these kinds of messages:

Jan 22 01:06:26 hostname sshd[1787]: input_userauth_request: invalid user foo [preauth]
Jan 22 01:06:58 hostname sshd[1794]: error: PAM: authentication error for root from via

I realize this is an old question, but I'm also looking for a more concrete (and perhaps ready-made) solution to this; were you (OP) able to find a satisfying answer?

As an aside, it might be more beneficial asking at AskDifferent.

share|improve this answer

Saying that attempts will be rare because you changed the port, means that most probably script kiddies will be "tricked" by this. Somebody will first use a program like NMap to scan your machine for open ports and afterwards try to connect to those.

Anyway, getting back to your question, you might want to first check these questions on Stack Overflow and Stack Exchange, which present interesting solution to your problem.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.