Mac OS X unusual bash activity?

Solution 1:

You can infer two facts that might be helpful:

First, the login was from ttys000. This means that the login was not via the network, but local. Second, since there is a typo in the commands ("l" instead of "ls") it certainly was a human typing these commands, and not a script.

So the question should be: who has physical access to your computer?

Solution 2:

The commands you listed in your question take you into the currently logged in user's Messaging App's message archive, lists the contents of that directory and then goes back to the currently logged in user's home directory. If you were logged in, then it's your messaging archive.

The exit command exits, or closes, the Terminal session, nothing more.

To see who has logged into your computer (or when the last time you logged in from where), type the command last in your Terminal:

$ last

To get a listing of the commands you have executed type:

$ history

If you want to save that to a file for later reading, type this:

$ history > ~/Desktop/history.txt

and a file will show up on your Desktop with all those commands. You can use the same technique for last but be sure to rename the file.

Now, if you want to see what happens when you are not in front of your Mac, just clear out the history before you leave with the command history -c. This way, you will see exactly what has been done when you weren't around.

Now, you obviously have a 2AM login into your computer. Why

a) do you not have a password

or

b) if you do have one, why is it shared with others?