Ubuntu
openssh package

  1. Bug #501956
  2. Comment #1

Comment 1 for bug 501956

Revision history for this message
Don Reid (thebunfighter) wrote :

auth_log in auth.c is not changing the error logging function from "authlog" to "logit" for this type of error (line 258). If you use "sshd start -dd" you will get the failed attempt clearly on the screen but NOT in auth.log.

NB. Setting LogLevel to VERBOSE does show the failed attempts quite well I think:

This account does not exist:
Feb 16 00:17:18 nono sshd[18101]: Connection from 192.168.0.247 port 36732
Feb 16 00:17:19 nono sshd[18101]: Invalid user r2 from 192.0.168.247

This account exists on the server but does not have a publickey:
Feb 16 00:17:24 nono sshd[18103]: Connection from 192.168.0.247 port 36733
Feb 16 00:17:24 nono sshd[18103]: Failed publickey for ob1 from 192.168.0.247 port 36733 ssh2

Also note that specifically denying users through the various allow/deny/user/group methods in sshd_config has an effect on the error logged as well.

However I agree that the 2nd line of the two should be logged as "INFO". Will continue tomorrow...

Regards, Don.