I wasn't sure if anyone had said anything about the OSSEC users showing up in the Login window on OSX. I didn't want them showing up as accounts to log on to the box with, so I've hidden them using the following command:
/usr/bin/sudo /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow \ HiddenUsersList -array-add ossec ossecm ossece ossecr That will hide the users from the login window on OSX, but an additional icon will show up labeled "Other". If you click on that icon in the login window, it will bring up a username/password screen that's empty (of user info). So that's the only drawback, is that it creates an additional icon in the login window labeled "Other". You can also manually hide/disable the ossec accounts from the login screen. Then the accounts don't show up at all, and you don't have an "Other" icon either. -Chuck
