Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I allow remote ssh login to my Mac. However I only can see my local login when running command who. I'm sure a remote session has login my Mac via ssh.

localhost% who
kane     console  Jul 10 22:21 
kane     ttys000  Jul 10 22:21 
kane     ttys001  Jul 10 22:21 
kane     ttys002  Jul 10 22:21 
kane     ttys003  Jul 10 22:21

In a linux host, it logins my Mac via below command,

user     12098 11413  0 21:01 ?        00:00:00 /usr/bin/ssh -L 27002: -R 27002: -q -N -o stricthostkeychecking=no -R 20008:localhost:6500 -R 20002:localhost:22

But in the linux host, who command can list ssh login. How can I get remote ssh login listed in my Mac?

user@ubuntu-server:~$ who
user     tty1         2012-07-05 18:26
user     pts/1        2012-07-23 22:10 (
share|improve this question
up vote 3 down vote accepted

I have no Mac to check, but on Unix there are generally some more commands to show who is logged in:

  • who (you already mentioned)
  • w (with detailed information)
  • users (you also tried; just shows names of currently logged-in users)
  • finger (with some personal information)

So maybe one of the not-yet-tried (i.e. w, finger) does its job correctly for you? If not, some more possibilities especially for OSX are listed in the article osx - How to know when and which user logged into the system.

share|improve this answer
Just for curiousity: Which of them finally did it on the Mac? – Izzy Jul 24 '12 at 7:54
both who and w are useful for identifying both local and remote sessions. I SSH'd into localhost and both of them were able to ID localhost as the origin. last appears to work as well. – Kevin Mark Nov 5 '13 at 5:35

On ubuntu you do last and you can see all ssh and non ssh logins. I don't have mac here, I will try when I get back. Bug quick google search tells me it works on mac too.

share|improve this answer
last can list the login history. However it still has different behaviors on Ubuntu and Mac. On ubuntu it knows which session is still logged in, user@ubuntu-server:~$ last user pts/1 Mon Jul 23 22:10 still logged in user pts/1 Mon Jul 23 22:04 - 22:04 (00:00) On Mac it doesn't think the ssh session is alive any more. But I can login the remote server via forwarding port. The ssh session actually is alive. localhost% last username ttys004 Mon Jul 23 20:02 - 20:02 (00:00) – Kane Jul 23 '12 at 14:31

You can grep the file /private/var/log/secure.log:

grep -E "sshd\[[1-9]+\]\: Accepted" /private/var/log/secure.log
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.