Review your favorite Linux distribution.
Go Back > Forums > Linux Forums > Linux - Security
User Name
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.


  Search this Thread
Old 02-14-2006, 12:59 AM   #1
Registered: Jul 2005
Location: West Coast South, USA
Distribution: debian 3.1
Posts: 267

Rep: Reputation: 36
ssh logging options

Hi folks.

okay, i have googled for 20 minutes and searched this site a bit on this issue, haven't found an answer....

... to this:

I regularly check my logs. I am running debian sarge on three servers opened to the net to ssh only. When I examine /var/log/auth.log from time to time I (of course) see huge numbers of entries for invalid log-on attempts.

I can see when someone tries to log on as an illegal user:

Feb 13 10:08:21 danimalz-server sshd[5053]: Illegal user franziska from

I can see when someone tries to log on as a (sshd.conf) 'not-allowed' user:

Feb 13 10:19:28 danimalz-server sshd[5927]: User root not allowed because not listed in AllowUsers

... but I can never see when there is a failed password for a 'legal' user. I know this happens, i have tested it.

?? why is this ??

And what do I need to setup so that I can see invalid password attempts for legal users..?

Just curious (I have 18 character totally random passwords for the only 'allowed' users on my systems - so I am not afraid of any breakins )...

Old 02-14-2006, 01:57 AM   #2
Senior Member
Registered: Nov 2002
Location: Edmonton AB, Canada
Distribution: Gentoo x86_64; Gentoo PPC; FreeBSD; OS X 10.9.4
Posts: 3,760
Blog Entries: 4

Rep: Reputation: 78
My system logs these failed logins, but I believe it is PAM that does it.
Does your system use PAM?
Old 02-14-2006, 02:35 AM   #3
Registered: Jul 2005
Location: West Coast South, USA
Distribution: debian 3.1
Posts: 267

Original Poster
Rep: Reputation: 36

Thank you for ure reply..!

yes, my system is mostly standard sarge, so it uses PAM for authentication.

Here's the thing: I find it strang that when I:

cat /var/log/auth.og | grep samson

I never get entries that have been recorded in the log for this name. Yet the names 'sam' 'sams' , etc. appear many times in the logs as 'Illegal' users. So I wonder if the scans are actually trying 'samson' and I just do not know about it.

Thing is this occurred also for 'root' - ie: i never got logs for scans that tried 'root'. Yet when i restricted all users xcept one, within sshd.conf, root began appearing in the logs, so I know this name (obviously) was being tried. Therefore, I am worried that the names appearing in /etc/passwd do not appear in the logs, in my system, as 'invalid users', and thusly I'll never see when they are being tried with invalid passwords. (i hope this makes sense).

I just again tested, and can see that when I attempted to log on to 'samson' (assume that this user is in /etc/passwd) with a bad password, there is indeed a log (three times) for bad password (this is from PAM). Perhaps the scans are using a different login method, one that does not automatically log into /var/log/auth.log.

... sigh... ... anyhow thanks!...



Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
ssh command logging jcookeman Linux - Security 3 08-26-2008 02:50 AM
[SSH] Issue logging in [SSH & Permissions] MD3 Linux - Networking 11 12-10-2006 09:25 AM
SSH - Logging out r4merlin Linux - Networking 1 11-02-2003 12:50 PM
SSH problems logging in ra_adi Linux - Networking 3 10-22-2003 12:55 PM
logging onto SSH robmainella Linux - Newbie 5 08-26-2003 02:21 PM > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 06:21 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration