How do I detect failed remote login attempts and block them?

Question

How do I detect failed remote login attempt on my MacBook Pro and how do I block them? My MacBook Pro is on a network with built-in firewall, if that's relevant.

Answer 1

Login attempts are logged in the file /var/log/secure.log, but there's a lot of other entries in the file also. You could search for lines containing the phrase "Failed to authenticate user" to narrow down the failed login attempts.

In Mac OS X, by default, telnet and rlogin are not enabled at all. As far as ssh is concerned, it can be turned off and on using System Preferences. If you deselect "Remote login" then it should not be possible to ssh into your computer.