LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Server (https://www.linuxquestions.org/questions/linux-server-73/)
-   -   SSH connection limitation and sshd debugging issues (https://www.linuxquestions.org/questions/linux-server-73/ssh-connection-limitation-and-sshd-debugging-issues-4175585547/)

siddharthmakwana 07-26-2016 08:47 AM

SSH connection limitation and sshd debugging issues
 
Is there any way to find out if ssh server is reaching out max connection limit? Also can it be logged in any log file. As far as I have seen, if max connection limit reaches, server will start dropping the connection but not sure if the same action is logged somewhere. I am using Ubuntu server instance.

Turbocapitalist 07-26-2016 12:30 PM

Do you mean broken connections as a result of MaxStartups limit being reached? As far as I can tell those are not logged either with the default logging level of INFO or the next level of VERBOSE. With either, the client will see a "ssh_exchange_identification: Connection closed by remote host" message, but that's it. Nothing is shown in the sever logs for them, however.

If you're just trying to fix a temporary problem, then you can look at LogLevel DEBUG. But that will only tell you that the connection was dropped not why. And running at LogLevel DEBUG or higher in production is not recommended as it violates the privacy of your users, so it's just for a temporary investigation.

siddharthmakwana 07-27-2016 01:57 AM

Quote:

Originally Posted by Turbocapitalist (Post 5581600)
Do you mean broken connections as a result of MaxStartups limit being reached? As far as I can tell those are not logged either with the default logging level of INFO or the next level of VERBOSE. With either, the client will see a "ssh_exchange_identification: Connection closed by remote host" message, but that's it. Nothing is shown in the sever logs for them, however.

If you're just trying to fix a temporary problem, then you can look at LogLevel DEBUG. But that will only tell you that the connection was dropped not why. And running at LogLevel DEBUG or higher in production is not recommended as it violates the privacy of your users, so it's just for a temporary investigation.


If I change LogLevel to DEBUG where will it log these DEBUG logs ?

Turbocapitalist 07-27-2016 03:34 AM

It will log to the same place as before. That is determined by the interaction between what sshd has for SyslogFacility and your system's logging software. The default settings for the latter vary from distro to distro. But in short, the default result is usually /var/log/auth.log


All times are GMT -5. The time now is 08:51 PM.