Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I allow remote ssh login to my Mac. However I only can see my local login when running command who. I'm sure a remote session has login my Mac via ssh.

localhost% who
kane     console  Jul 10 22:21 
kane     ttys000  Jul 10 22:21 
kane     ttys001  Jul 10 22:21 
kane     ttys002  Jul 10 22:21 
kane     ttys003  Jul 10 22:21

In a linux host, it logins my Mac via below command,

user     12098 11413  0 21:01 ?        00:00:00 /usr/bin/ssh -L 27002: -R 27002: -q -N -o stricthostkeychecking=no -R 20008:localhost:6500 -R 20002:localhost:22

But in the linux host, who command can list ssh login. How can I get remote ssh login listed in my Mac?

user@ubuntu-server:~$ who
user     tty1         2012-07-05 18:26
user     pts/1        2012-07-23 22:10 (
share|improve this question
up vote 3 down vote accepted

I have no Mac to check, but on Unix there are generally some more commands to show who is logged in:

  • who (you already mentioned)
  • w (with detailed information)
  • users (you also tried; just shows names of currently logged-in users)
  • finger (with some personal information)

So maybe one of the not-yet-tried (i.e. w, finger) does its job correctly for you? If not, some more possibilities especially for OSX are listed in the article osx - How to know when and which user logged into the system.

share|improve this answer
Just for curiousity: Which of them finally did it on the Mac? – Izzy Jul 24 '12 at 7:54
both who and w are useful for identifying both local and remote sessions. I SSH'd into localhost and both of them were able to ID localhost as the origin. last appears to work as well. – Kevin Mark Nov 5 '13 at 5:35

On ubuntu you do last and you can see all ssh and non ssh logins. I don't have mac here, I will try when I get back. Bug quick google search tells me it works on mac too.

share|improve this answer
last can list the login history. However it still has different behaviors on Ubuntu and Mac. On ubuntu it knows which session is still logged in, user@ubuntu-server:~$ last user pts/1 Mon Jul 23 22:10 still logged in user pts/1 Mon Jul 23 22:04 - 22:04 (00:00) On Mac it doesn't think the ssh session is alive any more. But I can login the remote server via forwarding port. The ssh session actually is alive. localhost% last username ttys004 Mon Jul 23 20:02 - 20:02 (00:00) – Kane Jul 23 '12 at 14:31

You can grep the file /private/var/log/secure.log:

grep -E "sshd\[[1-9]+\]\: Accepted" /private/var/log/secure.log
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .