Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I'm on a personal computer, with Lion running and only a single user account on the computer. Is there a log file for authentication attempts (both for login attempts and password protected screensaver aka sleep mode)?

Mostly interested in the unsuccessful attempts. Is it possible to also see the passwords that were used to make those unsuccessful attempts?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

It's found in the secure.log (the path is /var/log/secure.log) and the entries would look something like this:

authorizationhost[5917]: Failed to authenticate user <cksum> (error: 9).

It does not log password attempts (the password they tried to use), just the actual unsuccessful (or successful) login attempt.

share|improve this answer
    
note: The log does record the username attempted. –  Slomojo Sep 12 '11 at 2:26
    
@slomojo, yes it does (look to the name in the <> tag above). –  cksum Sep 12 '11 at 2:27
    
So there is no way to get the password as well? What would I use in that case (some kind of keylogger)? –  user10917 Sep 13 '11 at 6:15
1  
Yes, you will likely need a keylogger and one that can run without requiring a user to sign in. I'm not sure exactly how they work, so I can't be of help there. –  cksum Sep 13 '11 at 7:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.