[SSHGuard-users] SSHGuard not working in MacOS 10.12 (Sierra)

[Doug N. <dn...@uc...>]

Hi Folks,

I’m pretty sure SSHGuard is unable to work in MacOS 10.12 (Sierra) because of how Apple recently changed logging in this new OS upgrade. No longer are failed SSH logins recorded in /var/log/system.log or any other system log file, because Apple has moved to “unified logging”. 

A Terminal command like the following will show some of the information we’re after, but I’m not sure how this would need to be incorporated into SSHGuard to allow it to work as before:

% log show --predicate '(eventMessage CONTAINS "maximum authentication attempts exceeded")' --style syslog —info

If anyone has any suggestions or ideas please let me know, since I’m a big fan of SSHGuard and would to have it work in Sierra.

Cheers, Doug