Not trusting anyone, not even my own firewalls and other measures against invasive hackers, I like to be able to monitor any successful login to my OS X systems (e.g. by instantly sending an email to my gmail account).
How do I accomplish this, including logins via Screen Sharing and SSH?
I can see that the secure.log file lists such logins, but how do I monitor them, and filter them for successful logins, in order to issue emails about these events?
User bmike suggested using the tail command on the secure.log file. I found that this command has an option "-F" that is well suited for this task: I keeps reporting added lines to the log file, and even handles log file rotations.
But this is not sufficient for my needs yet. I only want to send out the notifications if an external access (login) occured, not every time a local task is getting authorized.
Here's an excerpt from my secure.log file:
mymac login: in pam_sm_acct_mgmt(): OpenDirectory - Membership cache TTL set to 1800. mymac login: in od_record_check_pwpolicy(): retval: 0 mymac login: in od_record_attribute_create_cfstring(): returned 3 attributes for dsAttrTypeStandard:AuthenticationAuthority mymac sudo: myname : 3 incorrect password attempts ; TTY=ttys005 ; PWD=/Users/myname ; USER=root ; COMMAND=/bin/bash mymac sudo: myname : TTY=ttys005 ; PWD=/Users/myname ; USER=root ; COMMAND=/bin/bash mymac com.apple.SecurityServer: Succeeded authorizing right 'system.hdd.smart' by client '/Library/Application Support/iStat local/iStatLocalDaemon'  for authorization created by '/Library/Application Support/iStat local/iStatLocalDaemon'  mymac sshd: Accepted publickey for myname from x.x.x.x port 62433 ssh2 mymac screensharingd: Authentication: SUCCEEDED :: User Name: John Doe :: Viewer Address: x.x.x.x :: Type: DH
Only the "screensharingd" and "sshd" ones are relevant to me in this example. But there seems to be no clear distinction between these and the other local authorizations. The only common pattern I find is the IP address, but is that fail-safe? I guess to make my script generally useable (by anyone), I'd have to not only detect IPv4 addresses but also IPv6 addresses. And can I be sure that other external types of logins (e.g. file sharing) will also list a IP address in their raw format like this? Not ever using symbolic names that I wouldn't be able to detect with this pattern?
Actually, I also logged in via File Sharing (AFP) - that didn't even get listed in secure.log, oddly! Which means that secure.log is probably not the only or not the central point of learning about authorizations.
I had hoped that there's some central point in OSX that takes care of all username/password authorizations and that this point would also provide some hook for monitoring.
I am afraid my question can't be answered sufficiently in a generic way. I'll go now and ask on Apple's security mailing list. I'll report back.
My reasoning for this kind of question is that I think that no system is safe from break-in. Therefore, relying on measures to prevent a break-in are not a safe measure alone. Adding (external) notifications about when a login into a system happens is what makes it much better controllable: If someone manages to break in, he'll be detected by this method, and so the system is then known not to be trusted any more and will be dealt with. Without this kind of monitoring, someone might be able to break in and then modify the system to a point where someone looking later won't be able to tell what happened, assuming the system is still safe.