User Logins and Accounting


User Logins and Accounting

If your Mac OS X computer is shared among multiple users, keeping track of their activity should be a reasonably important priority. Although it's possible to limit the applications a user can run in Mac OS X (see Chapter 13, "Mail Server Security," for details), how to track their activity on the BSD subsystem isn't as obvious.

As noted earlier, there are three binary logfiles that track users: logged-in users ( utmp) , user login/logout history ( wtmp ), and each user's last login ( lastlog ). This section of the chapter will document the utilities that read these files and introduce the idea of an accounting log, which will track exactly what each user does at the command line.

Current Users: who and w

To display information about the currently logged-in users, use the w or who commands. Each displays roughly the same information, gleaned from /var/run/utmp , but in a slightly different format.

Executing who , for example, provides an output of username, controlling terminal, date, and remote hostname:

 #  who -Hu  USER     LINE     WHEN         IDLE     FROM jray     console  Nov 22 10:47 01:26 jray     ttyp1    Nov 22 11:21   . jray     ttyp2    Nov 22 11:28   . sally    ttyp3    Nov 22 11:29 00:43    ( jray     ttyp4    Nov 22 11:27 00:43 sally    ttyp5    Nov 22 11:28 00:43    ( jray     ttyp6    Nov 22 11:35   . 


A terminal type of console indicates a login directly at the Mac OS X machine.

The syntax of who is who <options> [filename] . The options are defined in Table 19.4.

Table 19.4. who Command-Line Switches




Displays information about only the active terminal.


Prints a + or - after each username to indicate whether the terminal is writable (a la write <username> or talk <username> ).


Prints idle time for each user.


Displays column headings.

am I

Returns the real username of the person invoking the command.


If a filename is given on the commandline, who reads the results from that file, such as /var/log/wtmp , and displays the login/logout records for the stored user records.

Like who , the w command produces output on the actively logged-in users, but includes uptime stats and is also capable of sorting by idle time, displaying the IP (rather than hostname) of logged-in users, and filtering the output by a single user account. w also purports to display the current active process running in each terminal, but this does not currently function in Mac OS X. (Check a Linux system to see what the output should look like.)

For example:

 #  w -i  11:55AM  up 1 day,  1:09, 8 users, load averages: 0.00, 0.00, 0.00 USER    TTY FROM              LOGIN@  IDLE WHAT jray     p7 dhcp024-210-090- 11:45AM     0 - jray     p1 -                Fri11AM     5 - jray     p6 -                Fri11AM     5 - jray     p2 -                Fri11AM 23:42 - sally    p3 Fri11AM 24:26 - jray     p4 -                Fri11AM 24:26 - sally    p5 Fri11AM 24:26 - jray     co -                Fri10AM 25:09 - 

The syntax of w is simply w <options> [username] . Table 19.5 describes the basic command options.

Table 19.5. w Command-Line Switches




Suppresses heading.


Sorts the output by idle time.


Shows numeric IP addresses.


Filters the results for the specified username.

Login/Logout History: last and lastlog

The command last displays accounting information from /var/log/wtmp about who has logged in and out of the system, along with date and time of reboots, crashes, and shutdowns.

For example:

 %  last  jray      ttyp1    dhcp024-210-090- Sat Nov 23 13:01   still logged in ansci     ttyp3 Fri Nov 22 14:16 - 15:13  (00:56) ohioline  ttyp3 Fri Nov 22 14:15 - 14:15  (00:00) robyn     ttyp1 Fri Nov 22 14:12 - 14:20  (00:08) ansci     ttyp1 Fri Nov 22 12:45 - 13:26  (00:40) ansci     ttyp1 Fri Nov 22 12:43 - 12:43  (00:00) ohioline  ttyp1 Fri Nov 22 12:23 - 12:31  (00:08) robyn     ttyp1 Fri Nov 22 11:39 - 11:56  (00:17) joe       ttyp1                     Fri Nov 22 11:38 - 11:39  (00:00) joe       ttyp1                     Fri Nov 22 11:38 - 11:38  (00:00) jray      ttyp2 Fri Nov 22 11:36   still logged in robyn     ttyp1 Fri Nov 22 11:31 - 11:38  (00:06) robyn     ttyp1 Fri Nov 22 11:28 - 11:29  (00:00) jray      ttyp0 Fri Nov 22 11:28   still logged in robyn     ttyp0 Fri Nov 22 11:25 - 11:26  (00:01) jray      ttyp1 Thu Nov 21 15:11 - 15:39  (00:28) ohioline  ttyp1 Thu Nov 21 14:31 - 14:32  (00:01) 

Because the wtmp can become very large on an active machine, last has a number of filtering options for narrowing your output down to a specific user or host. The last syntax is last <options> [username] . The command-line switches for these features are documented in Table 19.6.

Table 19.6. last Command-Line Switches



-f <filename>

Reads from an alternative file, rather than /var/log/wtmp .

-n <number of lines>

Limits the output to the specified number of lines.

-t <tty filter>

Filters the results for a specific TTY (for example, -t console would display all direct logins).

-h <hostname or ip>

Filters based on a hostname or IP address.


If given, only records matching the given username will be displayed.

A similar log to wtmp resides in /var/log/lastlog , which provides a record of the last time each system user has logged in to the machine. Unfortunately, Apple does not provide the corresponding lastlog utility to read this file with Mac OS X. Although the same information can be fetched by reading through the output of last , this provides an alternative source that isn't dependent on the wmtp for its output. If you want you use the lastlog file, a simple reader is provided at The source, originally written for Solaris, has been slightly modified to run on Mac OS X.

The lastlog utility can be compiled ( assuming Apple's Developer Tools are installed) with gcc -o lastlog lastlog.c . The resulting executable ( lastlog ) displays the entire contents of /var/log/lastlog or limits the output to a single user by using the syntax lastlog [username] :

 %  ./lastlog  User       TTY      Date -------------------------------------------- root       console  Sat Aug 17 02:22:17 2002 jray       ttyp6    Sat Nov 23 13:14:43 2002 test       console  Sun Sep 15 11:24:24 2002 

Unfortunately, the user logs discussed so far, although they let you keep track of the who, when, and where of user activity, do not provide information about what the users are doing. For that, you'll need to enable user accounting on Mac OS X.

Tracking User Activity: accton and acct

If a user on your system causes a problem (such as attacking a remote system from a Mac OS X account), you can use wtmp to find out who was logged in at the same time of the attack, but on a system with hundreds of accounts there may be a few dozen simultaneous logins at the time of attack, or even if you identify the attacker you may be required to produce forensic evidence to back up your accusations.

System-level accounting can be activated via the accton command. By default, accounting is not provided as a startup option either through the Mac OS X interface or any of the Library/StartupItems . If you want to enable full-time accounting, you have to add it as a new startup item.

The accton command takes a single parameter: the pathname of the logfile to use. If the command is given without a filename, accounting is disabled. The default logfile location is /var/account/acct , which must be created before logging can be used:

 #  mkdir -p /var/account  #  touch /var/account/acct  #  chown -R root:admin /var/account   # chmod -R 660 /var/account  

After setting up the directory and logfile, start accounting with accton /var/account/acct :

 #  accton /var/account/acct  

Finally, you can perform reporting on the log by using lastcomm . For example, here is a brief excerpt of the accounting log:

 Mail       -S      jray     __       201.25 secs Fri Nov 22 03:20 (22:15:28.00) iTunes     -S      jray     __         2.84 secs Sat Nov 23 01:36 (0:00:08.97) cddafs.uti -S      root     __         0.02 secs Sat Nov 23 01:36 (0:00:00.14) cddafs.uti -S      root     __         0.00 secs Sat Nov 23 01:36 (0:00:00.00) cddafs.uti -S      root     __         0.03 secs Sat Nov 23 01:36 (0:00:00.47) Terminal   -S      jray     __         3.16 secs Fri Nov 22 23:01 (3:34:24.00) tcsh       -S      jray     ttyp1      0.09 secs Fri Nov 22 23:01 (3:34:16.00) nslookup   -X      jray     ttyp1      0.02 secs Sat Nov 23 01:12 (0:24:56.00) login      -SX     jray     ttyp1      0.97 secs Fri Nov 22 23:01 (3:34:16.00) sh         -S      root     __         0.05 secs Fri Nov 22 03:15 (0:00:06.30) rm         -S      root     __         0.00 secs Fri Nov 22 03:15 (0:00:00.00) sh         -SF     root     __         0.00 secs Fri Nov 22 03:15 (0:00:04.83) cat        -S      root     __         0.00 secs Fri Nov 22 03:15 (0:00:04.80) sh         -SF     root     __         0.02 secs Fri Nov 22 03:15 (0:00:04.83) cp         -S      root     __         0.00 secs Fri Nov 22 03:15 (0:00:00.00) cat        -S      root     __         0.00 secs Fri Nov 22 03:15 (0:00:00.00) 

Each line consists of the command executed, flags indicating the state of the process, the user, the controlling terminal, the CPU time used by the process, when the process was started, and, finally, the elapsed execution time of the process.

The process flags can be any combination of the following:

  • S . The process was run as the super user.

  • F . The process is the result of a fork.

  • D . The process terminated and wrote a core file (usually indicating a crash).

  • X . The process was terminated by a signal (such as is sent by the kill command).

The lastcomm utility syntax is lastcomm [-f file] [command <command> ] [user <user> ] [terminal <terminal> ] . Table 19.7 describes these command-line options and their purposes.

Table 19.7. lastcomm Command-Line Switches



-f <filename>

Read from an alternative accounting logfile, rather than /var/account/acct .

command <command>

Filter the output for a specified command.

user <user>

Filter the output for a specified user.

terminal <terminal>

Filter the output for a specified terminal.

For example, to view a history of the use of emacs on my machine, I could type:

 #  lastcomm emacs  emacs      -S      root     ttyp2      0.67 secs Mon Nov 18 23:45 (0:00:27.25) emacs      -S      root     ttyp2      0.67 secs Mon Nov 18 23:43 (0:00:25.91) emacs      -       jray     ttyp2      0.62 secs Mon Nov 18 23:43 (0:00:15.86) emacs      -       jray     ttyp2      0.53 secs Mon Nov 18 23:43 (0:00:02.66) 

The accounting log will grow very quickly; it will contain entries for commands that are executed via cron , spawned by other processes, or run from the Mac OS X Finder. On a busy system, you could easily see hundreds of entries per minute.

Starting accton at Bootup

To start accton at boot-time, create a new folder named Accounting in /Library/StartupItems . Into this folder, add two files: StartupParameters. plist and Accounting , with the following contents:

 StartupParameters.plist: {   Description     = "System Accounting";   Provides        = ("Process Accounting");   OrderPreference = "None";   Messages =   {     start = "Starting Accounting";   }; } Accounting: #!/bin/sh ## # Start Process Accounting ## . /etc/rc.common if [ "${ACCOUNTING:=-NO-}" = "-YES-" ]; then     ConsoleMessage "Starting Accounting"     /usr/sbin/accton /var/account/acct fi 

Finally, add the line ACCOUNTING=-YES- to /etc/hostconfig to turn the automatic startup on.


Mac OS X Maximum Security
Maximum Mac OS X Security
ISBN: 0672323818
EAN: 2147483647
Year: 2003
Pages: 158 © 2008-2017.
If you may any questions please contact us: