Re: sshd logging with key-only authentication

--uJNQuIR499bBFtzc
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Jul 08, 2010 at 07:42:15PM -0400, Glen Barber wrote:
> ...=20
> What caught my interest is if I attempt to log in from a machine where I=
=20
> do not have my key or an incorrect key, I see nothing logged in auth.log=
=20
> about a failed login attempt.  If I attempt with an invalid username, as=
=20
> expected, I see 'Invalid user ${USER} from ${IP}.'
>=20
> I'm more concerned with ssh login failures with valid user names.=20
> Looking at crypto/openssh/auth.c, allowed_user() returns true if the=20
> user is not in DenyUsers or DenyGroups, exists in AllowUsers or=20
> AllowGroups (if it is not empty), and has an executable shell.  I'm no C=
=20
> hacker, but superficially it looks like it can never meet a condition=20
> where the user is valid but the key is invalid to trigger a log entry.
>=20
> Is this a bug in openssh, or have I overlooked something in my=20
> configuration?

What I do is configure IPFW to log all attempted session-initiation packets
on 22/tcp, and correlate /var/log/auth.log & /var/log/security.

It's rather interesting to see how many entries show up in the latter
that have no corresponding entry in the former.

Peace,
david
--=20
David H. Wolfskill				[e-mail]
Depriving a girl or boy of an opportunity for education is evil.

See http://www.catwhisker.org/~david/publickey.gpg for my public key.

--uJNQuIR499bBFtzc
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.15 (FreeBSD)

iEYEARECAAYFAkw2mG8ACgkQmprOCmdXAD00gQCdHh/PqQDbfIfuVNOgWHwy6Su2
TW8AnRw/vYPlwRyj04jupXe7OhZd6eoU
=EKMy
-----END PGP SIGNATURE-----

--uJNQuIR499bBFtzc--