Bug#626112: openssh-server: ssh doesn't log some failed authentications to auth.log anymore
On Mon, May 09, 2011 at 12:15:19AM +0200, Christoph Anton Mitterer wrote:
> For *some* failed connections ssh seems to put no logging into
> auth.log anymore.
Did this work as you expect in some previous version? Which one?
> This can be quite security relevant when using e.g. fail2ban which relies on this.
>
> Only some (types?) of connections seem to be affected, as I still see few IPs
> that get banned by fail2ban.
>
> But when I e.g. go to another host of mine, and try repeatedly to login, they don't
> get banned (as nothing appears in the logs).
> I tried both, hosts where a ~/.ssh/id_rsa* was in place and not.
>
>
> Attached is my sshd's configuration. Please ask for mor information if you need any.
If you use 'LogLevel VERBOSE', does that help?
Can you provide some examples of log messages that fail2ban is noticing
and banning?
Thanks,
--
Colin Watson [cjwatson@debian.org]
Reply to: