6

On my VPS, running Debian 7, I have ssh enabled on the default port 22 with only private key authentication enabled, all other ports are filtered with iptables. I am frequently getting login attempts from china under bogus usernames, such as "plesk" or "r00t", showing up in my /var/log/auth.log

The only issue is for authentication attempts that don't present a private key and attempt login under a valid username, the only line that appears in the logs reads

sshd[4364]: Connection closed by 123.45.67.89 [preauth]

When sshd logging level is set to VERBOSE, an additional line is printed stating that a user connected and the port they connected from.

Is there any way to make sshd log that it disconnected a user because they lacked a private key?

1

The answer to your question is No. At least, not without taking heroic measures (e.g., running DEBUG level and processing it with scripts) that are much harder than some sensible alternatives. That same [preauth] error is reported for no key or an invalid key.

On the other hand, if they actually connect, your log will say explicitly

Jul  7 15:59:38 ws6 sshd[9578]: Accepted password for robohacker...

or

Jul  7 15:59:38 ws6 sshd[9578]: Accepted publickey for robohacker...

What you can usefully do is further harden your config. You've already required a key, you can also use the AllowUsers and AllowGroups commands to prevent connection by anyone not specifically authorized.

Personally, I always install DenyHosts, although it doesn't appear to have recent updates. I've heard that Fail2Ban is also good

1

You can use a "cheat" - in your /etc/pam.d/ssh(d) in the auth section you can add a log statement (pam_log) before the pam_unix or @include common-auth statements. If this statement is hit, then a password authentication has been attempted.

0

Any logging that sshd can do will be documented in man sshd_config. Try searching that for "log", but I don't see anything that specific there - mainly just LogLevel and SyslogFacility, although maybe MaxAuthTries would help.

0

When in verbose mode, your sshd will indeed already log the disconnect statement.

If you want more informations, you also can use the ultimate DEBUG logging mode, but, be really careful with this one because logs will growth fast without a good logrotate policy ;-)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.