ssh logging options
 

Hi folks.

okay, i have googled for 20 minutes and searched this site a bit on this issue, haven't found an answer....

... to this:

I regularly check my logs. I am running debian sarge on three servers opened to the net to ssh only. When I examine /var/log/auth.log from time to time I (of course) see huge numbers of entries for invalid log-on attempts.

I can see when someone tries to log on as an illegal user:

Feb 13 10:08:21 danimalz-server sshd[5053]: Illegal user franziska from 210.118.254.248

I can see when someone tries to log on as a (sshd.conf) 'not-allowed' user:

Feb 13 10:19:28 danimalz-server sshd[5927]: User root not allowed because not listed in AllowUsers

... but I can never see when there is a failed password for a 'legal' user. I know this happens, i have tested it.

?? why is this ??

And what do I need to setup so that I can see invalid password attempts for legal users..?

Just curious (I have 18 character totally random passwords for the only 'allowed' users on my systems - so I am not afraid of any breakins )...


CHeeers,
Danimalz

My system logs these failed logins, but I believe it is PAM that does it.
Does your system use PAM?

Bulliver,

Thank you for ure reply..!

yes, my system is mostly standard sarge, so it uses PAM for authentication.

Here's the thing: I find it strang that when I:

cat /var/log/auth.og | grep samson

I never get entries that have been recorded in the log for this name. Yet the names 'sam' 'sams' , etc. appear many times in the logs as 'Illegal' users. So I wonder if the scans are actually trying 'samson' and I just do not know about it.

Thing is this occurred also for 'root' - ie: i never got logs for scans that tried 'root'. Yet when i restricted all users xcept one, within sshd.conf, root began appearing in the logs, so I know this name (obviously) was being tried. Therefore, I am worried that the names appearing in /etc/passwd do not appear in the logs, in my system, as 'invalid users', and thusly I'll never see when they are being tried with invalid passwords. (i hope this makes sense).

I just again tested, and can see that when I attempted to log on to 'samson' (assume that this user is in /etc/passwd) with a bad password, there is indeed a log (three times) for bad password (this is from PAM). Perhaps the scans are using a different login method, one that does not automatically log into /var/log/auth.log.

... sigh... ... anyhow thanks!...

Danimalz