2

I'm suspecting a roommate somehow got my password, and I want to confirm this hypothesis. Is there a log that keeps track of successful and failed log-ins?

PS: I tried using the wake reasons log, but it's not accurate.

  • See this answer: apple.stackexchange.com/a/240690/119271 – Allan Feb 21 '18 at 11:56
  • @Allan Using syslog | grep 'login\[' the most recent entry is in February 19, and I logged in today (Feb 21). Whatever it's logging, it's not up-to-date – user264053 Feb 21 '18 at 12:24
  • 1
    Did you login or unlock your machine? – Allan Feb 21 '18 at 12:26
  • You are right, syslog isn't sufficient to help you here. You should look at the saved syslog: zgrep 'login\[' /var/log/system.log.*.gz . – dan Feb 21 '18 at 13:35
  • Could you give us some more information to get a correct information: [return]- How your roommate would have used your account: direct access to keyboard, remote access through ssh or ARD or any RAT?[return]- What is the easiest way to get your password: is it shared on a server which got compromised, is it pretty easy, did you write it somewhere? – dan Feb 21 '18 at 13:42
3

I'd use the Terminal command last for a more complete list of logins.

Execute the command last [yourusername] will generate a list of tty and console logins.

Ex: last icondaemon generates:

icondaemon     ttys000                   Wed Feb 21 08:12   still logged in
icondaemon     console                   Wed Feb 21 07:57   still logged in
icondaemon     console                   Tue Feb 20 07:52 - 15:24  (07:31)
icondaemon     console                   Fri Feb 16 07:16 - 16:03  (08:46)
icondaemon     console                   Thu Feb 15 07:33 - 16:25  (08:51)
icondaemon     ttys000                   Wed Feb 14 09:34 - 09:34  (00:00)
icondaemon     ttys000                   Wed Feb 14 09:34 - 09:34  (00:00)
icondaemon     console                   Wed Feb 14 07:36 - 16:19  (08:42)
icondaemon     console                   Tue Feb 13 07:31 - 15:57  (08:25)
icondaemon     console                   Mon Feb 12 07:32 - 16:30  (08:57)
icondaemon     console                   Fri Feb  9 08:51 - 15:48  (06:57)

...

icondaemon     ttys000                   Wed Nov  1 15:22 - 15:22  (00:00)
icondaemon     ttys000                   Wed Nov  1 15:21 - 15:21  (00:00)
icondaemon     console                   Wed Nov  1 11:36 - 15:53  (04:16)

I'm not sure what happened on November 1st to rollover the log.

  • Most probably periodic / monthly ran on the 1st of November. – dan Feb 21 '18 at 13:36
  • Nope. I executed the periodic command manually, but the list remains the same. – IconDaemon Feb 21 '18 at 13:41
  • 1
    I guess there is an undocumented problem around this file management. Read /etc/periodic/monthly/200.accounting. – dan Feb 21 '18 at 13:50

You must log in to answer this question.