I have a mac mini server running OS X Lion Server 10.7.3. It pretty much runs unattended without problems. However, the server is under constant "attack" according to the logs. The firewall and security is holding up it seems.

Is there any application/script that can send me an email whenever someone/anyone logs into the server using SSH, Admin Tools or ARD?

Since the machine runs unattended, headless in a datacenter in a different city, I'm concerned that someone may (through pure persistance) manages to crack a password or find a compromise on the system. Knowing I'll get alerted will put my mind to ease.

  • 2
    Not really an answer therefore a comment : have you considered using something like fail2ban ([How-Tow](fail2ban.org/wiki/index.php/HOWTO_Mac_OS_X_Server_(10.5) )? That way you can ban IP's you get attacked from. You set the rules for how long they are banned, etc. It would help you prevent getting hacked. And that's maybe more helpful then getting an email for every login attempt.
    – boretom
    Commented Mar 24, 2012 at 14:49

6 Answers 6


Your best defence is always to turn off unnecessary services. If you're not using remote desktop: turn it off. If you're not using the HTTP or FTP servers: turn them off. Fewer services running, fewer points of entry for possibly intruders to exploit.

Aside from locking it down, there are some free and open source products that are OS X friendly you can look at to do intrusion detection on your machine.


Though I haven't personally run it, I do have colleagues who know and trust it for intrusion detection. It's BSD-compatible so it makes a it a good fit for OS X. Another upside to going with Snort is it's available as a Homebrew package:

> brew info snort
Depends on: daq, libdnet, pcre
Not installed

==> Caveats
For snort to be functional, you need to update the permissions for /dev/bpf*
so that they can be read by non-root users.  This can be done manually using:
    sudo chmod 644 /dev/bpf*
or you could create a startup item to do this for you.

So you get a simplified path to installation and some trust in the fact that it ports well to OS X and runs there. With Homebrew installed you only need to do:

> brew install snort

And you're ready to get started with it.

Check out this Snort for OS X Lion Server setup guide that the Snort community provides to get started with rule writing for your OS X machine. That's a great document and, in addition to walking through installing Snort from source (which you don't need to do), it talks about all the things you should do your OS X Lion Server instance to help protect it. If you install via Homebrew, start at Section 5 (page 13) in the PDF since you don't need to worry about installing it from source code.


I've run Tripwire on linux machines to do rapid intrusion detection and alerting. It's effective but it's a bit of a beast to set up. It can perform actions when rules are matched against log files. Of course, a savvy hacker is going to know to disable Tripwire as soon as they break in so they don't end up with their session getting cut off.

The MacWorld hint talks about setting up Tripwire on OS X. It's not simple and the article ends with mentioning that it's not been tested.

  • The OS X Lion Server adaptive firewall has done a great job keeping people out. What benefit does Tripwire and Snort give me compared to the standard firewall? Is it worth the effort?
    – bloudraak
    Commented Mar 27, 2012 at 1:41
  • 1
    Neither Tripwire or Snort are meant to be firewall replacements. They are intrusion detection systems. They use a bunch of different approaches to monitoring your system logs for suspicious activity and can take action based on monitoring outcomes like emailing you or shutting off remote daemons or closing down network ports.
    – Ian C.
    Commented Mar 27, 2012 at 1:43

You can harden ssh and install denyhosts, sshguard, and Snort, Barnyard, Base and Swatch.

See these links for details:

https://discussions.apple.com/thread/3565475 https://discussions.apple.com/thread/4473229?tstart=0

  1. Turn off root and password logins:

    vi /etc/sshd_config

    PermitRootLogin no
    PasswordAuthentication no
    ChallengeResponseAuthenticatio no

    Then use ssh-keygen on the remote client to generate public/private keys that can be used to remotely login to the server:  

    client$ ssh-keygen -t rsa -b 2048 -C client_name [Securely copy ~/.ssh/id_rsa.pub from client to server.] server$ cat id_rsa.pub > ~/.ssh/known_hosts  

  2. Install denyhosts and sshguard.

    • sudo port install denyhosts sshguard
    • sudo port load denyhosts
    • sudo port load sshguard

    You can configure denyhosts to block all traffic, not just ssh traffic.

  3. Snort, with a world map of attacks:



To directly answer the question posed. I have another script that emails me, again, around midnight, if anyone successfully logs in via ssh.

#!/usr/bin/env bash

mm=`date +%b`
dd=`date $1 +%d`
dd=`expr $dd`
if [ "$dd" -ge "10" ]
    dt=`echo "$mm $dd"` 
    dt=`echo "$mm  $dd"` 

cat /var/log/secure.log | grep -E '(Accepted|SUCCEEDED)'| grep -E -v '(my.ip.address|192.168.1)' | grep "$dt" >> /tmp/access_granted

/usr/bin/mail -E -s "Access granted" [email protected] < /tmp/access_granted
rm /tmp/access_granted

Edit the grep above to exclude your own fixed IP, if you want, and to use your email address. You can combine some of the code in my other answer to add failures for VNC.

  • I created the script to run on a schedule and I'm waiting for tonights email.
    – bloudraak
    Commented Mar 27, 2012 at 1:38
  • The trouble with doing things on a daily basis is by the time you catch wind of the intrusion the damage may already be done.
    – Ian C.
    Commented Mar 27, 2012 at 1:44
  • @Ian C. - agreed, but you can always increase the frequency of the email. Additionally, you've got to have some faith in the intrusion prevention measures that you set up. I have a very reasonable degree of confidence in my Fail2ban setup.
    – afragen
    Commented Mar 27, 2012 at 21:17

To expand a bit on Fail2ban, once it is set up and running I have a script that I run just before midnight that scrapes the logs and emails me what Fail2ban has been doing for the previous day.

The script is as follows and can be run from cron or a launchd plist.

#!/usr/bin/env bash

mm=`date +%b`
dd=`date $1 +%d`
dd=`expr $dd`
if [ "$dd" -ge "10" ]
    dt=`echo "$mm $dd"` 
    dt=`echo "$mm  $dd"` 

cat /var/log/system.log | grep "$dt" | grep org.fail2ban | grep -v COMMAND > /tmp/fail2ban_deny
cat /var/log/fail2ban.log | grep -E '(WARN|ERR|rotation|target)' | grep `date $1 +%Y-%m-%d` >> /tmp/fail2ban_deny
cat /var/log/ipfw.log | grep TCP | grep "$dt" >> /tmp/fail2ban_deny
cat /var/log/secure.log | grep VNC | grep FAILED | grep "$dt" >> /tmp/fail2ban_deny

/usr/bin/mail -E -s "Fail2ban ipfw" [email protected] < /tmp/fail2ban_deny
rm /tmp/fail2ban_deny

You will obviously need to use the email address of your choice.

Setting up Fail2ban is a whole other issue. I've written extensively about it.


It's fairly simple to install Google Authenticator PAM plugin on Mac OS X if you have X code command line compiler installed. The code and instructions are here:


Once you initialize your token (generate a code you feed to the app on your phone), you'll have two factor authentication to protect your machine. Any account without an initialized token won't be able to login, so if you don't want to allow root login, don't initialize a key for that account.

But seriously, something like DenyHosts just makes sense if you have to keep SSH open on the internet. Unfortunately, since Mac OS X V10.8, Apple's removed tcpwrappers support from the SSH daemon, so it ignores /etc/deny.hosts, which was a dumb move, if you ask me, removing a security feature.

To work around that, I used MacPorts to install an up-to-date openssh daemon, and restore the full tcpwrappers functionality, edited and use DenyHosts daemon to monitor /var/log/system.log and ban IPs that are guessing logins and passwords. And don't forget to update MacPorts and check/reinstall openssh/DenyHosts every time you upgrade the OS.

Good Luck!


I realize that this is an old post but I figured this might help someone that cannot program or save them time scouring the web. I just wrote this on my lunch break and it will email successful and failed attempts as well as blocked IPs via failed attempts. The program is written in Ruby. Sendmail is installed along with the mail and file-tail gems.

Source code below:


require 'mail'
require 'file-tail'

def sendMail(mail_subject,mail_body,dest_email,port)
  Mail.defaults do
    delivery_method :smtp, address: "localhost", port: port

  mail = Mail.new do
    from     '[email protected]'
    to        dest_email
    subject   mail_subject
    body      mail_body

  mail.delivery_method :sendmail

File.open('/var/log/auth.log') do |log|
  log.interval = 10
  log.tail do |line| 
    puts line if line.match(/ssh.*accepted password.*$/i)
    sendMail('New SSH Connection',line,'[email protected]',445) if line.match(/ssh.*accepted password.*$/i)

    puts line if line.match(/ssh.*failed password.*$/i)
    sendMail('Failed SSH attempt',line,'[email protected]',445) if line.match(/ssh.*failed password.*$/i)

    puts line if line.match(/sshguard.*$/i)
    sendMail('SSH IP Blocked', line,'[email protected]',445) if line.match(/sshguard.*$/i)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .