How to check how many remote ssh logins in my macosx

I allow remote ssh login to my Mac. However I only can see my local login when running command who. I'm sure a remote session has login my Mac via ssh.

localhost% who
kane     console  Jul 10 22:21 
kane     ttys000  Jul 10 22:21 
kane     ttys001  Jul 10 22:21 
kane     ttys002  Jul 10 22:21 
kane     ttys003  Jul 10 22:21

In a linux host, it logins my Mac via below command,

user     12098 11413  0 21:01 ?        00:00:00 /usr/bin/ssh -L 27002:127.0.0.1:27002 -R 27002:127.0.0.1:27003 -q -N -o stricthostkeychecking=no -R 20008:localhost:6500 -R 20002:localhost:22 username@myhost.com

But in the linux host, who command can list ssh login. How can I get remote ssh login listed in my Mac?

user@ubuntu-server:~$ who
user     tty1         2012-07-05 18:26
user     pts/1        2012-07-23 22:10 (123.120.xxx.xxx)

Kane

Posted 2012-07-23T14:16:15.233

Reputation: 305

Answers

I have no Mac to check, but on Unix there are generally some more commands to show who is logged in:

who (you already mentioned)
w (with detailed information)
users (you also tried; just shows names of currently logged-in users)
finger (with some personal information)

So maybe one of the not-yet-tried (i.e. w, finger) does its job correctly for you? If not, some more possibilities especially for OSX are listed in the article osx - How to know when and which user logged into the system.

Izzy

Posted 2012-07-23T14:16:15.233

Reputation: 3 187

1Just for curiousity: Which of them finally did it on the Mac? – Izzy – 2012-07-24T07:54:08.030

1both who and w are useful for identifying both local and remote sessions. I SSH'd into localhost and both of them were able to ID localhost as the origin. last appears to work as well. – Kevin Mark – 2013-11-05T05:35:09.390

On ubuntu you do last and you can see all ssh and non ssh logins. I don't have mac here, I will try when I get back. Bug quick google search tells me it works on mac too.

user98645

Posted 2012-07-23T14:16:15.233

Reputation:

last can list the login history. However it still has different behaviors on Ubuntu and Mac.

On ubuntu it knows which session is still logged in, user@ubuntu-server:~$ last user pts/1 123.120.xxx.xxx Mon Jul 23 22:10 still logged in user pts/1 127.0.0.1 Mon Jul 23 22:04 - 22:04 (00:00)

On Mac it doesn't think the ssh session is alive any more. But I can login the remote server via forwarding port. The ssh session actually is alive.

localhost% last username ttys004 114.249.xxx.xxx Mon Jul 23 20:02 - 20:02 (00:00) – Kane – 2012-07-23T14:31:49.550

You can grep the file /private/var/log/secure.log:

grep -E "sshd\[[1-9]+\]\: Accepted" /private/var/log/secure.log

audiomason

Posted 2012-07-23T14:16:15.233

Reputation: 203