<div dir="ltr"><div><div><div><div>Thanks for the info Brandon.<br><br></div>The problem is, I'm not getting the same info with syslog as I used to with /var/log/secure.log in Mac 10.6.<br><br></div>Doing "syslog | less", doesn't show any logins, either successful or not, from ssh.<br>
<br></div>Doing "less /var/log/appfirewall.log" shows when the Mac firewall let in an ssh connection, which is helpful, but I would also like to know the IP address of the connecting machine.<br><br></div>Is there anyway I can log the IP address of connecting machines, regardless of whether the ssh login is successful or not, with syslog?<br>
<br>Thanks for your help.<br><br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Jun 30, 2014 at 10:45 AM, Brandon Allbery <span dir="ltr"><<a href="mailto:allbery.b@gmail.com" target="_blank">allbery.b@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div class="">On Mon, Jun 30, 2014 at 2:25 AM, Alan <span dir="ltr"><<a href="mailto:gorzarg@gmail.com" target="_blank">gorzarg@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div><div>I'm not sure where macports' sshd writes its logging info. (e.g. for ubuntu, sshd writes it to /var/log/auth.log.)<br></div><br>Is there a similar file for macports?<br></div></div></blockquote>
<div><br></div></div><div>sshd logs via the system syslog facility. On most Linuxes, this means files under /var/log as specified by some variant of /etc/syslog.conf --- but there are a number of syslogd variants. In my Fedora 19 VM it's rsyslogd and the primary control file is /etc/rsyslogd.conf. I don't recall what Ubuntu uses off the top of my head.</div>
<div><br></div><div>Apple replaced syslog with the Apple System Log facility, and you use /Applications/Utilities/Console.app to view them from the GUI or the syslog command to view from terminal. `man syslog` for details, including pointers to config files that will tell you how it emulates traditional syslogd and where it routes messages with facility AUTH and severity INFO or higher.</div>
<span class="HOEnZb"><font color="#888888">
</font></span></div><span class="HOEnZb"><font color="#888888"><div><br></div>-- <br><div dir="ltr"><div>brandon s allbery kf8nh sine nomine associates</div><div><a href="mailto:allbery.b@gmail.com" target="_blank">allbery.b@gmail.com</a> <a href="mailto:ballbery@sinenomine.net" target="_blank">ballbery@sinenomine.net</a></div>
<div>unix, openafs, kerberos, infrastructure, xmonad <a href="http://sinenomine.net" target="_blank">http://sinenomine.net</a></div></div>
</font></span></div></div>
</blockquote></div><br></div>