Following the latest security vulnerability in Mac OS High Sierra, where the root user had no password (seriously, see this), I'd be curious to find out, if I was a victim of this attack.

How can I get a list of successful logins on the 'root' account, say for the past 30 days?

Have tried the following: How to print last login time? however that command does not work on High Sierra.

  • Possible duplicate of How to print last login time? – Romeo Ninov Nov 30 '17 at 9:49
  • thanks for pointing out @RomeoNinov. Have updated my question. Does not work on High Sierra. – FooBar Nov 30 '17 at 9:54
  • @RomeoNinov This maybe a duplicate, but not of that one. That script only is intended to display the time of the last login. – Rui F Ribeiro Nov 30 '17 at 9:59
  • @RuiFRibeiro, correct. But it give info how to see the last logins in general. Because the OP did not do even small research how this can be done – Romeo Ninov Nov 30 '17 at 10:51

To see a list of successful logins in MacOS:

  • open Terminal
  • run the "last" command as in:

    last | grep ^root

You will get a list of the last root logins in reverse chronological order, if any. To see the entries for all users, just use last alone.

Beware a user with root privileges can cover it's tracks.

P.S. the solution from How to print last login time? does not work in MacOS because the lastcommand in MacOS does not support the -R option (at least). Moreover, that answer is only intended to print the time of the last login of any user for a linux version of the last command.

Adding to the answer, you can also run the ac command:

$ac -p
rui        128.40
total      128.40

This command will output the sum of time the logged in users were active.

| improve this answer | |
  • 1
    I have already tried last. It only prints wtmp begins Thu Nov 30 11:53 (current timestamp). – FooBar Nov 30 '17 at 9:53
  • empty? odd thing - you might try the ac command but I suspect it is just another view in the same data. – Rui F Ribeiro Nov 30 '17 at 10:17
  • I found the issue, it's because I have to run the command as an administrator. – FooBar Nov 30 '17 at 10:18
  • I don't know OSX, but on Linux, if last reports the last logins (actually the openings of terminals), access to files via SFTP doesn't show in its output... And I'm not even sure it shows the logging in of the graphical UI. So IMHO it isn't trustable as a check that the system hasn't been "visited". – xenoid Nov 30 '17 at 10:31
  • @xenoid This is related to a recent OS/X local flaw (already fixed); root by default cannot ssh/scp – Rui F Ribeiro Nov 30 '17 at 17:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.