How to find logs of Remote Management and Remote Login on my Mac?

Question

Today I was going to share my WiFi internet connection, when I realized I had the Remote Management sharing turned on, on my Mac, giving all privileges to all users including Guests.

I thought it was very strange, since I have never set this sharing myself and I don't think this comes as a default setting in Mountain Lion system.

So, I got a bit paranoid of possible hacking and spying, and I want to discover how I can see if someone logged in, and remotely and monitored/viewed my computer.

Maybe someone know the string match I should type on the system Console to find remote connections? Maybe I can see that in a specific log file? Or maybe someone knows a command in the terminal that shows me the log of all computers that connect to mine? I know the port mainly used to this Remote Management is the 5900.

Please, I am very worried about this, and I want to find out who did this thing.

Solution

You will find messages related to the process "screensharingd" in the system.log file.

screensharingd messages notify you of what IP is trying to log in as well as the user account that it's trying to use. An example string looks like:

2013-01-10 4:34:44.154 PM screensharingd[803]: Authentication: SUCCEEDED :: User Name: user_account :: Viewer Address: ip_address :: Type: DH

You might also want to look for the following path in your system.log file:

/System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Support/writesettings

That should indicate when the VNC Server has been initialized.

To address your concerns about being hacked or spied on, though, I think I should mention that Remote Management deals only with Apple Remote Desktop and the VNC Server. The chances of someone spying on you with ARD is very, very low. To see if someone could be spying on you with VNC server, go to the Remote Management section in Sharing and then click on Computer Settings. If "VNC viewers may control computer with password ..." is selected, then that could be cause for concern. Otherwise, VNC is turned off.

To see if people have access to your computer via ARD, go to the Remote Management pane and then click on the Options button. If everything is unchecked, then nobody has remote access to your system.