View Full Version : OSX Login History

26th September 2006, 06:23 PM
Is there a way to view records of the last few logins on OSX? I am currently living in an environment where there is a higher than usual chance of my computer being tampered with. I take most of the usual precautions - disabled automatic login, a solid alphanumeric jumbled password that is changed regularly, etc but when I got home today and logged in, my computer was behaving very strangely for the first time. Camino and Safari wasn't working the way they're currently configured, e.g. open links in a new windows instead of tabs, randomly asking me if I really wanted to clear my cache. And the Dock was configured for Hiding, which it never is.

It is unlikely, but I would like to be sure. Any tips?

26th September 2006, 06:51 PM
in terminal type last


26th September 2006, 07:05 PM
That's cool, I didn't know that :)

26th September 2006, 07:06 PM
And do a permissions repair while you're checking. (In Disk Utility)

26th September 2006, 07:13 PM
Thanks for the peace of mind all.

26th September 2006, 07:24 PM
I suppose you could always take a look in the Console.

HD -> Applications folder -> Utilities folder -> Console

With Console open, click on Logs icon, and beneath that in the left column, click on: system.log - and scroll down to the entries beginning at the right date.

Here's another way, though somewhat vulgar and primitive. If you have an iBook or Powerbook or MacBook, remove a strand of your own hair (yes - from your head) - cut it so it's only an inch long, stick your finger up your nose and remove just the slightest discharge from there - (bear with me) - apply to both ends of the hair, and stick to the upper and lower casing of your your book - no one else would notice it. If you return and it's broken, someone's opened your Book.

(An old shared flat fridge trick to detect the midnight food thief).

If you have an iMac or other Desk model, it's less repulsive. Simply get a felt-tipped pen that is non-permanent and will rub off real easy when applied to plastics, and place the tiniest dot on the start up key - and / or the Mouse, and if it's gone or smudged when you return - you'll know someone - or something has touched it.

The other possibility is to have an Open Firmware Password as an extra option. To do this, restart your Apple Mac with the following keys held down:

Apple :cmd: + option + O + F

A grey screen with grey text will appear.

See here (http://docs.info.apple.com/article.html?artnum=106482) for instructions.

It's a great method to protect as it won't even let a another user through even if they try using a Boot CD, yet the danger here, is that you really MUST remember your password. The only way to deactivate an Open Firmware Password - as far as I know, is to remove the RAM Modules and then slot them back in.

I believe you can even download an Open FirmWare Password Application from Apple (http://www.apple.com/downloads/macosx/apple/openfirmwarepassword.html) !

See here (http://www.versiontracker.com/dyn/moreinfo/macosx/12932) also.



26th September 2006, 08:20 PM
*Makes a note never to buy a snotty laptop from Clockwork :P

Of course,a nice easy way is just do a quick search for everything modified for that day. Then you can find out what has been touched and, possibly, who played with it.

26th September 2006, 09:45 PM

ibook 4 sale - special edition - slightly... off white...