How to check how many remote ssh logins in my macosx

Question

I allow remote ssh login to my Mac. However I only can see my local login when running command who. I'm sure a remote session has login my Mac via ssh.

localhost% who
kane     console  Jul 10 22:21 
kane     ttys000  Jul 10 22:21 
kane     ttys001  Jul 10 22:21 
kane     ttys002  Jul 10 22:21 
kane     ttys003  Jul 10 22:21

In a linux host, it logins my Mac via below command,

user     12098 11413  0 21:01 ?        00:00:00 /usr/bin/ssh -L 27002:127.0.0.1:27002 -R 27002:127.0.0.1:27003 -q -N -o stricthostkeychecking=no -R 20008:localhost:6500 -R 20002:localhost:22 [email protected]

But in the linux host, who command can list ssh login. How can I get remote ssh login listed in my Mac?

user@ubuntu-server:~$ who
user     tty1         2012-07-05 18:26
user     pts/1        2012-07-23 22:10 (123.120.xxx.xxx)

Solution 1

I have no Mac to check, but on Unix there are generally some more commands to show who is logged in:

• who (you already mentioned)
• w (with detailed information)
• users (you also tried; just shows names of currently logged-in users)
• finger (with some personal information)

So maybe one of the not-yet-tried (i.e. w, finger) does its job correctly for you? If not, some more possibilities especially for OSX are listed in the article osx - How to know when and which user logged into the system.

Solution 2

On ubuntu you do last and you can see all ssh and non ssh logins. I don't have mac here, I will try when I get back. Bug quick google search tells me it works on mac too.

Comments

[Kane]

last can list the login history. However it still has different behaviors on Ubuntu and Mac. On ubuntu it knows which session is still logged in, user@ubuntu-server:~$ last user pts/1 123.120.xxx.xxx Mon Jul 23 22:10 still logged in user pts/1 127.0.0.1 Mon Jul 23 22:04 - 22:04 (00:00) On Mac it doesn't think the ssh session is alive any more. But I can login the remote server via forwarding port. The ssh session actually is alive. localhost% last username ttys004 114.249.xxx.xxx Mon Jul 23 20:02 - 20:02 (00:00)

[nirav]

both who and w are useful for identifying both local and remote sessions. I SSH'd into localhost and both of them were able to ID localhost as the origin. last appears to work as well.