Notifications
Clear all

OS X Login attempts

7 Posts
4 Users
0 Reactions
1,487 Views
pajkow
(@pajkow)
Estimable Member
Joined: 17 years ago
Posts: 81
Topic starter  

Hi All,

Got an image of Apple Mac book Pro with iOS 10.8.5 and looking for info in the logs for a number and time and date of failed logins due to wrong password

So far I have checked this log

\private\var\log\system.log - in here there are some entries like this

Date/Time local loginwindow[56] in pam_sm_authenticate() Got user xxxxxxx
Date/Time local loginwindow[56] in pam_sm_authenticate() Got ruser xxxxxxx
Date/Time local loginwindow[56] in pam_sm_authenticate() Got service xxxxxxx
Date/Time local loginwindow[56] in od_principal_for_user() No authentication authority returned
Date/Time local loginwindow[56] in od_principal_for_user() failed 7
Date/Time local loginwindow[56]] in pam_sm_authenticate() Failed to determine Kerberos principal name.
Date/Time local loginwindow in pam_sm_authenticate() Done cleanup3
Date/Time local loginwindow[56]) Kerberos 5 refuses you
Date/Time local loginwindow[56] OpenDirectory - The authtok is incorrect.
Date/Time local.local coreservicesd[30] Application App"Apple80211Agent" [ 0x0/0x20d20d] @ 0x0x7f
cf63c3e410 tried to be brought forward, but isn't in fPermittedFrontASNs ( ( ASN0x0-0x1001) ), so denying.
Date/Time local.local WindowServer[77] [cps/setfront] Failed setting the front application to Apple
80211Agent, psn 0x0-0x20d20d, securitySessionID=0x186a6, err=-13066

And few minutes later

Date/Time local loginwindow[56] resume called when there was already a timer
Date/Time.local loginwindow[56] in pam_sm_authenticate() Got user xxxxxxx
Date/Time.local loginwindow[56] in pam_sm_authenticate() Got ruser xxxxxxx
Date/Time local loginwindow[56] in pam_sm_authenticate() Got service screensaver
Date/Time.local loginwindow[56] in od_principal_for_user() No authentication authority returned
Date/Time.local loginwindow[56] in od_principal_for_user() failed 7
Date/Time.local loginwindow[56] in pam_sm_authenticate() Failed to determine Kerberos principal name.
Date/Time local loginwindow[56] in pam_sm_authenticate() Done cleanup3
Date/Time loginwindow[56] in pam_sm_authenticate() Kerberos 5 refuses you
Date/Time loginwindow[56] in pam_sm_acct_mgmt() OpenDirectory - Membership cache TTL s

I assume this means that the user could not log in due to the wrong password…?Any other places to verify this?

Does anyone have any good log parser for MAC Logs?


   
Quote
Bulldawg
(@bulldawg)
Estimable Member
Joined: 13 years ago
Posts: 190
 

A little Googling tells me Kerberos is a network authentication protocol. What you are probably seeing is attempts from the system to authenticate to a service that's not accepting the credentials.

Does this occur at regular intervals? If so, it's almost certainly something the system is doing, not the user. I suggest you Google a few more of the log messages and see what comes up.

I think you mean OS X. iOS is for iPhones, iPads, and iPods and the latest version is 7.0.2.


   
ReplyQuote
pajkow
(@pajkow)
Estimable Member
Joined: 17 years ago
Posts: 81
Topic starter  

Bulldawg - Yes it is OS X

Ok, so in this case where to look for a number of successful/unsuccessful login attempts and time stamps?


   
ReplyQuote
Bulldawg
(@bulldawg)
Estimable Member
Joined: 13 years ago
Posts: 190
 

What I'm saying is that it looks like the system is possbily generating these log entries because of a misconfigured service. One way to see if that's true is look at the timestamps and see if there is a failure logged at regular intervals. If the events are all exactly 15 minutes apart, for example, then that's a pretty strong case that it's not human interaction generating those events.

This is all just conjecture on my part, and it requires some testing before you can conclude anything.

To be more sure, I suggest you get a Mac running the same version of OS X and generate some login failures to see what happens. If you get these same messages, then you know what they are, if you get something else, then at least you know these aren't login failures and you can move on to looking at the next posibility.


   
ReplyQuote
(@sgware)
Eminent Member
Joined: 13 years ago
Posts: 42
 

After reading this thread I started looking around in my OS X 10.8.5 machine. Looking through an an image of my 10.8.5 machine in XWF, seems that private\var\log\asl is where you might find some pieces of the login attempt puzzle. I don't have a parser for the .asl (apple system log) files. But the link below will help point you to the resources to properly analyze the files.

http//crucialsecurityblog.harris.com/tag/log/

I didn't have time to dig too deep, but, am very interested in the outcome. Please post a briefing of what you find.


   
ReplyQuote
(@alexc)
Reputable Member
Joined: 16 years ago
Posts: 301
 

Have you looked at the ASL logs (if there are any)?

I found some login/authentication stuff there when I was playing around with them previously. Details here http//digitalinvestigation.wordpress.com/2012/06/18/parsing-apple-system-log-files-osx-ios/


   
ReplyQuote
pajkow
(@pajkow)
Estimable Member
Joined: 17 years ago
Posts: 81
Topic starter  

Will do , thx


   
ReplyQuote
Share: