Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I know utilities such as last exist - but not sure if it's applicable for my needs - I'd like a system to notify me of any login attempts on any of my macs (home, work or remote). Attempts from a physically at the machine, or via ssh, Telnet, FTP, scp, sftp, vnc etc, etc.

I also know of a few commercial products but there seems to be no reviews for then so I'm not that trusting of them!

Can anyone recommend anything?

I have posted this in security as I feel it's a valid intrusion detection mechanism

share|improve this question

closed as off-topic by Xander, TildalWave, Scott Pack, Terry Chia, Adnan Oct 12 '13 at 10:06

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

    
I agree that this is a valid intrusion detection mechanism, however, questions asking specifically for product recommendations are out of scope and therefore off-topic for this site. –  Xander Oct 11 '13 at 20:10
    
Apologies - I'm actually hoping to use internal mac tools, such as last and log files - but am not overly familiar with the mac internals in this area –  SockThief Oct 11 '13 at 20:44
    
→ SockThief: Could you specify what kind of analysis and reaction you are looking for? Do you want an immediate warning on intrusion or a compilation at the end of the day? Do you want to blacklist immediately any IP source of an ssh rejected attempt? Do you want to play a warning sound when the number of attacks is above 10 / hour? –  daniel Azuelos Oct 11 '13 at 21:55
    
At this stage, I think immediate notification with blacklist option. If I get a notification then I can always login and kill any session etc, and can compile stats - so for now I'm mostly interested in detecting login attempts (successful or failed) - fail2block is an option on Linux - but I think the mac port wasn't so good iirc –  SockThief Oct 11 '13 at 22:38

1 Answer 1

I'd advise you to start searching for "log analysis" on this forum. (Then refine your initial question to get better answers.)

Most of the discussions on this topic and on any different Unix will build on top of Mac OS X.

You could start by this one which is focusing a larger target than your one: How do you handle log analysis?

I advise you to install logwatch, which you can do with either MacPorts, or the traditionnal way: tar, configure, make….

To be more on the active side, I advise you to install fail2ban, which you can also do the same 2 ways and Brew.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.