0

I started for some reason OSX's Log console and just found out someone was attacking me with ssh connexion's

I had over 500 of these messages (just the user name was chaging) in 5 minutes :

23/09/13 14:55:04,638 sshd[18830]: error: PAM: unknown user for illegal user crystal from 193.183.98.218 via 192.168.0.12

Do you know a way to get some kind of warning popup when a process sends a lot of logs like here ?

  • Get the application called Little Snitch. – Ruskes Sep 23 '13 at 13:43
  • Do you have access to the computer with IP 192.168.0.12? – nohillside Sep 23 '13 at 14:26
  • Hard to say what it is, but for blocking it, please take a look at this question which may help apple.stackexchange.com/questions/94282/… – stuffe Sep 23 '13 at 15:34
  • @patrix it's my ip behind my NAT router. – Matthieu Riegler Sep 23 '13 at 15:39
1

I do not know how to monitor the console for a specific message and send an alert.

However, there is a alternative approaches to monitoring or even block a specific ssh activity.

Without taking any credit (other than finding it), I would advice you to look up at some suggested solutions here that might apply to your situation.

Getting notified when someone logs into a server using SSH or Remote Desktop

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .