I am using an Aiport Extreme as my wireless router, and it has port forwarding set up but disabled for SSH: Screen shot of my configuration window The port forward settings sheet

However, I keep seeing instances of ssh login attempts from outside -- someone is trying to access my computer using a series of user names. Moreover, I can still log in from outside my home network using SSH, so I know it's open to the world.

How is this happening? How do I stop it?


Here is the log for a connection attempt:

==> /var/log/system.log <==
Apr 10 10:36:41: --- last message repeated 8 times ---
Apr 10 10:36:41 null-3 sandboxd[56246]: sshd(68515) deny mach-per-user-lookup

==> /var/log/secure.log <==
Apr 10 10:36:43 null-3 sshd[68516]: Invalid user presto from
  • Can you post the log entry for one of the ssh attempts?
    – user5037
    Apr 10, 2011 at 16:30

3 Answers 3


I am pretty sure when you select remote log in in the sharing preference pane, OS X opens the port on the router programmatically using NAT-PMP. Have you tried disabling that on the airport and rebooting?

Turn off NAT-PMP

Also be sure you are not editing a profile that is not active on the Airport. I have fallen into that trap once or twice every so often.

  • That'd be a pain; I have other services that use this. I'll have to experiment to see if that's the case.
    – Chris R
    Jun 9, 2011 at 23:16
  • It's the answer to why - as you note, you could do it temporarily for testing to make sure it's the case. Then you can look into csc.liv.ac.uk/~greg/sshdfilter to cut off hosts that try to brute force your mac.
    – bmike
    Jun 10, 2011 at 0:05
  • I ended up installing sshdfilter. Thanks for the tip!
    – Chris R
    Jul 27, 2011 at 13:47

I would turn off your remote access until you know your home network isn't public so that someone doesn't access it besides you.

  • No can do; I need ssh access to the machine, just not so much from outside.
    – Chris R
    Apr 10, 2011 at 17:53
  • You may be able to set up password on your AirPort Extreme router, I know that many programs written for wireless connection require set passwords in order to attempt the connection you might be able to do the same.
    – luca590
    Apr 11, 2011 at 0:46

I am not familiar with the Airport Extreme admin but it looks like you have SSH remote login turned off in the first dialog, and then in the second dialog add it manually mapping external port 22 to internal ip port 22. What you are seeing is someone (usually a script kiddie) trying a dictionary attack against your system.

If you must have ssh access then I would suggest running it on a non standard external port, which you map to the internal address and port 22. On Linux boxes to prevent this type of activity I normally install DenyHosts which seems to have a Mac port available. This monitors the logs of the ssh daemon, and adds the ip of any system that had a configurable number of failed login attempts within a time window to /etc/hosts.deny

  • The second screen shot is a detail of the first; it's the view of the disabled SSH setting in that dialog.
    – Chris R
    Apr 10, 2011 at 23:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .