Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.mac.system > #74986 > unrolled thread

Viewing login failures under OS X

Back to article view | Back to comp.sys.mac.system

Contents

  Viewing login failures under OS X User Bp <bp@www.zefox.net> - 2015-05-07 02:45 +0000
    Re: Viewing login failures under OS X Alan Baker <email@domain.com> - 2015-05-06 20:06 -0700
      Re: Viewing login failures under OS X User Bp <bp@www.zefox.net> - 2015-05-08 03:39 +0000
        Re: Viewing login failures under OS X JF Mezei <jfmezei.spamnot@vaxination.ca> - 2015-05-07 23:48 -0400
          Re: Viewing login failures under OS X Alan Baker <email@domain.com> - 2015-05-10 11:10 -0700
            Re: Viewing login failures under OS X awoolmeyer@gmail.com - 2015-05-12 11:46 -0700
              Re: Viewing login failures under OS X Alan Baker <email@domain.com> - 2015-05-12 11:48 -0700
    Re: Viewing login failures under OS X David Ritz <dritz@mindspring.com> - 2015-05-07 11:44 -0500

#74986 — Viewing login failures under OS X

What's the simplest way to check for failed login attempts
and other hacking/cracking stunts under OS X?  My FreeBSD
boxes send me emails with log files, my OS X box says nothing
and offers no obvious clues where to look. It's 10.7.5, the
hardware won't support anything newer.

Thanks for reading,

bob prohaska
 

[toc] | [next] | [standalone]

#74988

On 2015-05-07 02:45:17 +0000, User Bp said:

> What's the simplest way to check for failed login attempts
> and other hacking/cracking stunts under OS X?  My FreeBSD
> boxes send me emails with log files, my OS X box says nothing
> and offers no obvious clues where to look. It's 10.7.5, the
> hardware won't support anything newer.
> 
> Thanks for reading,
> 
> bob prohaska
> 

Try the Console app. Under "All Messages" look for "authorizationhost" entries.

[toc] | [prev] | [next] | [standalone]

#75112

Alan Baker <email@domain.com> wrote:
> 
> Try the Console app. Under "All Messages" look for "authorizationhost" entries.

There are three instances of:

5/5/15 11:29:55.156 PM authorizationhost: SFBuiltinEntitled: Installer.app is not entitled for system.install.app-store-software

Nothing referring to ssh or sftp, so I guess all is good. The date given is about the time I upgraded some software,
but there didn't seem to be any problem with the upgrade. 

Thanks for your help!

bob prohaska

[toc] | [prev] | [next] | [standalone]

#75113

On 15-05-07 23:39, User Bp wrote:

> Nothing referring to ssh or sftp, so I guess all is good. The date given is about the time I upgraded some software,
> but there didn't seem to be any problem with the upgrade. 

Try to login with wrong password at a specific known time and then
search the logs for it.


the file /etc/syslog.conf can give you hints on which messages go to
which files, and you can then do greps on those files.

[toc] | [prev] | [next] | [standalone]

#75290

On 2015-05-08 03:48:34 +0000, JF Mezei said:

> On 15-05-07 23:39, User Bp wrote:
> 
>> Nothing referring to ssh or sftp, so I guess all is good. The date 
>> given is about the time I upgraded some software,
>> but there didn't seem to be any problem with the upgrade.
> 
> Try to login with wrong password at a specific known time and then
> search the logs for it.
> 
> 
> the file /etc/syslog.conf can give you hints on which messages go to
> which files, and you can then do greps on those files.

With later versions of the OS, most messages end up in the Spotlight 
searchable "All messages" (in fact, you can set up a permanent query 
for it: "sender contains authorizationhost", and I did precisely what 
you said:

5/6/15 8:04:19.433 PM authorizationhost[26050]: Failed to authenticate 
user <usernameRedacted> (error: 9).

That won't catch ssh logins, but you can set up a query that looks for:

[ sender = "authorizationhost" OR sender = "sshd" ]

And that will cover both cases.

:-)

[toc] | [prev] | [next] | [standalone]

#75486

On Sunday, May 10, 2015 at 2:11:01 PM UTC-4, Alan Baker wrote:
> On 2015-05-08 03:48:34 +0000, JF Mezei said:
> 
> > On 15-05-07 23:39, User Bp wrote:
> > 
> >> Nothing referring to ssh or sftp, so I guess all is good. The date 
> >> given is about the time I upgraded some software,
> >> but there didn't seem to be any problem with the upgrade.
> > 
> > Try to login with wrong password at a specific known time and then
> > search the logs for it.
> > 
> > 
> > the file /etc/syslog.conf can give you hints on which messages go to
> > which files, and you can then do greps on those files.
> 
> With later versions of the OS, most messages end up in the Spotlight 
> searchable "All messages" (in fact, you can set up a permanent query 
> for it: "sender contains authorizationhost", and I did precisely what 
> you said:
> 
> 5/6/15 8:04:19.433 PM authorizationhost[26050]: Failed to authenticate 
> user <usernameRedacted> (error: 9).
> 
> That won't catch ssh logins, but you can set up a query that looks for:
> 
> [ sender = "authorizationhost" OR sender = "sshd" ]
> 
> And that will cover both cases.


WOW!!!  Windows actually copied that shit???

[toc] | [prev] | [next] | [standalone]

#75487

On 2015-05-12 18:46:58 +0000, awoolmeyer@gmail.com said:

> On Sunday, May 10, 2015 at 2:11:01 PM UTC-4, Alan Baker wrote:
>> On 2015-05-08 03:48:34 +0000, JF Mezei said:
>> 
>>> On 15-05-07 23:39, User Bp wrote:
>>> 
>>>> Nothing referring to ssh or sftp, so I guess all is good. The date
>>>> given is about the time I upgraded some software,
>>>> but there didn't seem to be any problem with the upgrade.
>>> 
>>> Try to login with wrong password at a specific known time and then
>>> search the logs for it.
>>> 
>>> 
>>> the file /etc/syslog.conf can give you hints on which messages go to
>>> which files, and you can then do greps on those files.
>> 
>> With later versions of the OS, most messages end up in the Spotlight
>> searchable "All messages" (in fact, you can set up a permanent query
>> for it: "sender contains authorizationhost", and I did precisely what
>> you said:
>> 
>> 5/6/15 8:04:19.433 PM authorizationhost[26050]: Failed to authenticate
>> user <usernameRedacted> (error: 9).
>> 
>> That won't catch ssh logins, but you can set up a query that looks for:
>> 
>> [ sender = "authorizationhost" OR sender = "sshd" ]
>> 
>> And that will cover both cases.
> 
> 
> WOW!!!  Windows actually copied that shit???

What are you blathering about, fish?

[toc] | [prev] | [next] | [standalone]

#75006

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
NotDashEscaped: You need GnuPG to verify this message

On Thursday, 07 May 2015 02:45 -0000, 
 in article <miejjt$e7p$1@news.albasani.net>, 
 User Bp <bp@www.zefox.net> wrote:

> What's the simplest way to check for failed login attempts and other 
> hacking/cracking stunts under OS X?  My FreeBSD boxes send me emails 
> with log files, my OS X box says nothing and offers no obvious clues 
> where to look. It's 10.7.5, the hardware won't support anything 
> newer.

If you're looking for ssh dictionary attacks, try checking 
/var/log/system.log* files for sshd references.  This may be easiest 
using /Applications/Utilities/Console.app.

If you're looking for HTTP exploit attacks, check 
/var/log/apache2/error_log and /var/log/apache2/access_log.

For any other ports you have open to the world, check the logs 
specific to those protocols.

-- 
David Ritz <dritz@mindspring.com>
 Be kind to animals; kiss a shark.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iEYEARECAAYFAlVLll8ACgkQUrwpmRoS3uttlgCguOFvGo63iOCy2j6A1i6CDmyF
atUAoItTVil6f4rHgdWeq+J9z9rIZiOv
=bbLP
-----END PGP SIGNATURE-----

[toc] | [prev] | [standalone]

Back to top | Article view | comp.sys.mac.system

csiph-web