Re: ssh and scp and odd log reporting
* Preben Randhol (randhol@pvv.org) [020202 05:22]:
> Is this a normal log response when one use scp from one Debian machine
> to another:
>
> debian-security@lists.debian.org
> Is this a normal log response when one use scp from one Debian machine
> to another:
>
> sshd[2494]: Accepted keyboard-interactive for krutt from +XXX.XXX.XXX.XXX port 32803 ssh2
>
> PAM_unix[2494]: (ssh) session opened for user krutt by +(uid=0)
>
> PAM_unix[2494]: (ssh) session closed for user krutt
>
> sshd[2494]: PAM pam_putenv: delete non-existent entry; MAIL
>
> (I have removed the IP and dates etc)
>
> I get this every time I use scp. What does : "Accepted
> keyboard-interactive for krutt" and "delete non-existent entry; MAIL"
The "Accepted keyboard-interactive" bit is given by your ssh server.
It's just letting you know that krutt connected using the
keyboard-interactive authentication method. Other values you might see
there in other lines in your log are password or publickey. You should
see these for any connection to your ssh server, not just scp.
The next one is from the pam_putenv module. I don't use it and am not
too familiar with its use, but the error message looks like it's trying
to unset the MAIL environment variable which was already unset. Do you
see this with every ssh connection or just scp? You may be able to find
more info by looking at /etc/pam.d/ssh to see what reference there is to
pam_putenv.
>
> and on the other machine it says: stdin: is not a tty.
>
> If I use scp towards another machine (not a Debian) I dont see the:
> stdin: is not a tty
This I don't know; perhaps someone else has an answer.
good times,
Vineet
--
Currently seeking opportunities in the SF Bay Area
Please see http://www.doorstop.net/resume/
--
Satan laughs when we kill each other. Peace is the only way.
Reply to: