6

I allow remote ssh login to my Mac. However I only can see my local login when running command who. I'm sure a remote session has login my Mac via ssh.

localhost% who
kane     console  Jul 10 22:21 
kane     ttys000  Jul 10 22:21 
kane     ttys001  Jul 10 22:21 
kane     ttys002  Jul 10 22:21 
kane     ttys003  Jul 10 22:21

In a linux host, it logins my Mac via below command,

user     12098 11413  0 21:01 ?        00:00:00 /usr/bin/ssh -L 27002:127.0.0.1:27002 -R 27002:127.0.0.1:27003 -q -N -o stricthostkeychecking=no -R 20008:localhost:6500 -R 20002:localhost:22 [email protected]

But in the linux host, who command can list ssh login. How can I get remote ssh login listed in my Mac?

user@ubuntu-server:~$ who
user     tty1         2012-07-05 18:26
user     pts/1        2012-07-23 22:10 (123.120.xxx.xxx)
Improve this question

3 Answers 3

Reset to default
8

I have no Mac to check, but on Unix there are generally some more commands to show who is logged in:

  • who (you already mentioned)
  • w (with detailed information)
  • users (you also tried; just shows names of currently logged-in users)
  • finger (with some personal information)

So maybe one of the not-yet-tried (i.e. w, finger) does its job correctly for you? If not, some more possibilities especially for OSX are listed in the article osx - How to know when and which user logged into the system.

Improve this answer
2
  • 1
    Just for curiousity: Which of them finally did it on the Mac?
    – Izzy
    Jul 24, 2012 at 7:54
  • 1
    both who and w are useful for identifying both local and remote sessions. I SSH'd into localhost and both of them were able to ID localhost as the origin. last appears to work as well.
    – Kevin Mark
    Nov 5, 2013 at 5:35
3

On ubuntu you do last and you can see all ssh and non ssh logins. I don't have mac here, I will try when I get back. Bug quick google search tells me it works on mac too.

Improve this answer
1
  • last can list the login history. However it still has different behaviors on Ubuntu and Mac. On ubuntu it knows which session is still logged in, user@ubuntu-server:~$ last user pts/1 123.120.xxx.xxx Mon Jul 23 22:10 still logged in user pts/1 127.0.0.1 Mon Jul 23 22:04 - 22:04 (00:00) On Mac it doesn't think the ssh session is alive any more. But I can login the remote server via forwarding port. The ssh session actually is alive. localhost% last username ttys004 114.249.xxx.xxx Mon Jul 23 20:02 - 20:02 (00:00)
    – Kane
    Jul 23, 2012 at 14:31
0

You can grep the file /private/var/log/secure.log:

grep -E "sshd\[[1-9]+\]\: Accepted" /private/var/log/secure.log
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .