Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On Debian Squeeze I have sshd set up to not permit password logins and require key based authentication.

I notice that when I attempt to log in from the WAN into my box with a bad SSH key, I do not get the "Failed publickey...." message in auth.log. I only get "Connection from...." logged and that's it.

When I log in from within my LAN to my box with a bad key, I do get "Failed publickey...." logged. I want to be able to log all failed publickey attempts to SSH.

Does anyone have any advice as to why it's not logging failed keys from the WAN?

share|improve this question
add comment

1 Answer 1

up vote 2 down vote accepted

I generally recommend increasing the default logging for sshd.The default loglevel is INFO, which gives you some minimal levels of information, but certainly not all. I recommend cranking that up to VERBOSE which will give you such events as the fingerprint of the key used for authentication, a log message when the user logs off, and should contain the failures that you're interested in.

Edit your /etc/ssh/sshd_config and find the setting for LogLevel. Change that such that it is

LogLevel VERBOSE

Then restart the sshd service.

share|improve this answer
    
Thanks Scott. Sorry, I should have mentioned before that I already changed logging to VERBOSE. This did not fix the issue, however. –  user158389 Feb 10 '13 at 19:59
    
@user158389: I blame Debian because it's always easier to debugging anything related to authentication. –  Scott Pack Feb 10 '13 at 20:03
    
FACEPALM. I am an idiot. I was trying to connect from the WAN via a small shell server I have at Rackspace. The user account that I was using did not have an SSH key. Once I generated a key, then tried to connect to my SSH server in question, it logged the Failed publickey. So it looks like if the user has no key, it does not get logged in auth.log. –  user158389 Feb 10 '13 at 20:12
    
@user158389: Which does make quite a bit of sense since there's no key to fail. –  Scott Pack Feb 11 '13 at 1:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.