I want to automatically ban IP address which attempt to login to my file server unauthorized.

I can log SSH login attempts including IP address in macOS to a syslog format file for further processing with fail2ban like so:

log stream --predicate '(process == "sshd")' --style syslog --level info --type=log >> /opt/local/var/log/logstreams/sshd.log

However, the smbd process doesn't seem to log IP by default. How can I achieve the above for smbd?

1 Answer 1


You could fire up and configure the BSD packetfilter - create a rule that will match incoming 'rogue' SMB requests, and in that rule use the log keyword which will cause all packets matching that rule to be, er, logged.

Walkthough here: https://blog.neilsabol.site/post/quickly-easily-adding-pf-packet-filter-firewall-rules-macos-osx/

In-depth explanation here: http://marckerr.com/a-simple-guild-to-the-mac-pf-firewall/

Explanation of the pf logging function here:https://www.openbsd.org/faq/pf/logging.html

Setting up pfctl anchors for a protocol: https://ikawnoclast.com/systems/firewall/mac-os-x-pf-firewall/

  • Can you add the specific rule(s) required directly to your question? The linked pages have a lot of useful information but don't seem to explain how to accomplish what you describe in the first paragraph.
    – nohillside
    Commented Nov 14, 2019 at 16:54
  • Sorry, but this isn't helpful. I know how to configure pf. Getting IP addresses of unauthorized login attempts is the issue.
    – hgv
    Commented Nov 14, 2019 at 19:30
  • Ok, sorry; can you still use pfctl anchors to log and block after a specified number of attempts on a particular protocol? Commented Nov 14, 2019 at 21:56
  • I don't know if that's possible or not. I'm using fail2ban for blocking because it allows me to exponentially increase ban time of repeated attempts.
    – hgv
    Commented Nov 15, 2019 at 16:21
  • Not sure that anchor tables will allow you to increase ban time - from what I understand, it just outright bans the IP for good. Commented Nov 16, 2019 at 8:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .