Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I thought this would be a good place to ask this question:

I want to open up my default SSH port (enable remote management in system settings and port forward my router) to see how many unauthorized access attempts I receive. Doing this as an experiment, I just wanted some advice before I do it.

In OSX, if I enable remote login but have no users in the "allowed access for: only these users", does this make my system impenetrable, no matter how hard someone tries to force (or bruteforce) their way in?

Are there any other precautions you would suggest I take?

Also, newly in OSX Mountain Lion, intrusion logs have been merged with the system.log file. When I look at it via console, it's all lost in a jumble of other irrelevant data that I have to sift through. Is there a way to only display the specific types of logs that I'm looking for?

share|improve this question

migrated from serverfault.com Aug 14 '13 at 0:55

This question came from our site for professional system and network administrators.

1  
Nothing is impenetrable. If you open a port, then whatever is listening on that port and its flaws are open to the world. If there are any known - or unknown - security flaws in that program then you are taking a risk. I would say the risk is minimal, but still there. –  Keltari Aug 14 '13 at 1:09
    
since SSH is SSH, wouldn't running a VM with a honey pot be more useful? –  Journeyman Geek Aug 14 '13 at 1:09
    
Just so you know, there are bots running all over the internet perpetually looking for ssh and running brute force attempts against them (poorly in my experience). There are probably stats available already without going to the trouble. –  Paul Aug 14 '13 at 3:45

2 Answers 2

In OSX, if I enable remote login but have no users in the "allowed access for: only these users", does this make my system impenetrable, no matter how hard someone tries to force (or bruteforce) their way in?

If "Allow access for" is set to "Only these users:" and the user list is empty, then no one will be able to log in using ssh.

Also, newly in OSX Mountain Lion, intrusion logs have been merged with the system.log file. When I look at it via console, it's all lost in a jumble of other irrelevant data that I have to sift through. Is there a way to only display the specific types of logs that I'm looking for?

The "Console" application allows you to view the system log and filter it based on arbitrary strings (the filter control is in the top right of the console window). So if you filter it on sshd, you'll only see messages from (or mentioning) sshd.

share|improve this answer
    
Ok great, thanks for the info. I was filtering by sshd, just wanted to make sure I wasn't missing any other relevant logs. –  user Aug 14 '13 at 1:10

What you want to setup is a honeypot, see http://en.wikipedia.org/wiki/Honeypot_(computing). I wouldn't do it with the real SSH daemon

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.