How to monitor logins to Screen Sharing and SSH?

Question

Not trusting anyone, not even my own firewalls and other measures against invasive hackers, I like to be able to monitor any successful login to my OS X systems (e.g. by instantly sending an email to my gmail account).

How do I accomplish this, including logins via Screen Sharing and SSH?

I can see that the secure.log file lists such logins, but how do I monitor them, and filter them for successful logins, in order to issue emails about these events?

User bmike suggested using the tail command on the secure.log file. I found that this command has an option "-F" that is well suited for this task: I keeps reporting added lines to the log file, and even handles log file rotations.

But this is not sufficient for my needs yet. I only want to send out the notifications if an external access (login) occured, not every time a local task is getting authorized.

Here's an excerpt from my secure.log file:

mymac login[26292]: in pam_sm_acct_mgmt(): OpenDirectory - Membership cache TTL set to 1800.
mymac login[26292]: in od_record_check_pwpolicy(): retval: 0
mymac login[26292]: in od_record_attribute_create_cfstring(): returned 3 attributes for dsAttrTypeStandard:AuthenticationAuthority
mymac sudo[26296]:    myname : 3 incorrect password attempts ; TTY=ttys005 ; PWD=/Users/myname ; USER=root ; COMMAND=/bin/bash
mymac sudo[26301]:    myname : TTY=ttys005 ; PWD=/Users/myname ; USER=root ; COMMAND=/bin/bash
mymac com.apple.SecurityServer[27]: Succeeded authorizing right 'system.hdd.smart' by client '/Library/Application Support/iStat local/iStatLocalDaemon' [133] for authorization created by '/Library/Application Support/iStat local/iStatLocalDaemon' [133]
mymac sshd[26308]: Accepted publickey for myname from x.x.x.x port 62433 ssh2
mymac screensharingd[26328]: Authentication: SUCCEEDED :: User Name: John Doe :: Viewer Address: x.x.x.x :: Type: DH

Only the "screensharingd" and "sshd" ones are relevant to me in this example. But there seems to be no clear distinction between these and the other local authorizations. The only common pattern I find is the IP address, but is that fail-safe? I guess to make my script generally useable (by anyone), I'd have to not only detect IPv4 addresses but also IPv6 addresses. And can I be sure that other external types of logins (e.g. file sharing) will also list a IP address in their raw format like this? Not ever using symbolic names that I wouldn't be able to detect with this pattern?

Actually, I also logged in via File Sharing (AFP) - that didn't even get listed in secure.log, oddly! Which means that secure.log is probably not the only or not the central point of learning about authorizations.

I had hoped that there's some central point in OSX that takes care of all username/password authorizations and that this point would also provide some hook for monitoring.

I am afraid my question can't be answered sufficiently in a generic way. I'll go now and ask on Apple's security mailing list. I'll report back.

Background:

My reasoning for this kind of question is that I think that no system is safe from break-in. Therefore, relying on measures to prevent a break-in are not a safe measure alone. Adding (external) notifications about when a login into a system happens is what makes it much better controllable: If someone manages to break in, he'll be detected by this method, and so the system is then known not to be trusted any more and will be dealt with. Without this kind of monitoring, someone might be able to break in and then modify the system to a point where someone looking later won't be able to tell what happened, assuming the system is still safe.

Answer 1

Yes - it would be more efficient to tail -f the log file so that your script only has to parse each line in the file once rather an once per interval.

Of course, you then still need to write and test the code to monitor for times when the logfile gets rotated and perhaps double check at you didn't miss an event by scanning the entire new file once when you first attach to that file.

What is best is a trade off between your comfort level and your skills. It MIT also make sense to sniff the network traffic since screen sharing listens on known ports, or you could monitor for new processes listening on new ports or you could turn on process auditing and monitor those logs or you could parse the process table. There are many ways to skin this cat.

Answer 2

If you have already worked out how to mine the information from the log, then a simple way of getting it to run only when required rather than polling it every day/hour etc is to add the script as a login action to the users in question. Get them to interpret the logs, work out if it's a local or remote login, and email (or imessage etc) appropriately.