3

I am running on a RHEL 6 operating system. I can see failed login attempt (password failures) in my /var/log/secure file. However, I don't see attempts to ssh to the server when the key is not correct. For example, if I issue the ssh request:

   ssh -o BatchMode=yes -i ./id_rsa  uname@10.70.22.99

It comes back with:

   Permission denied (publickey,password,keyboard-interactive).

However, this failure does not seem to be logged in /var/log/secure. Any ideas? I even have LogLevel VERBOSE set in the sshd_config file.

3

You can have multiple keys in a SSH agent. All those keys will be tested for a ssh connection, even if only one is allowed. For this reason ssh client doesn't consider a failed key as an authentication problem. Only when all authentication methods fail it will return a failure.

2
  • How do I know then that somebody is trying to connect to my system? Is this tracked through some other log?
    – GregH
    Sep 4 '15 at 19:36
  • 3
    Why are you worried about it? If your system is on the network, people will try to connect. There are questions on this site that you can search that have answers about blocking or minimizing lots of incoming SSH attempts. You can get more information from SSH if you bump up the log verbosity, but you will also get lots of log information that you won't care about.
    – Zoredache
    Sep 4 '15 at 21:53
3

How does public key authentication works in openssh?

To make it completely clear what is happening, the public key authentication works in two steps. One is just informative and the other checks to whole keypair.

The first step

is just checking if the offered public key matches some of the keys available in the servers authorized_keys file and is not logged as an error in default log level, because many people just store their keys in agent or somewhere and offer them to all the servers. This usually falls back to password authentication. If you set up VERBOSE log level, you should see also this message in /var/log/secure (at least with recent rhel6 openssh package).

The second step

verifies the possession of private part and it does the real asymmetrical cryptography and if this one fails, it should be logged, because it is more like failed authentication attempt.

Is brute-force feasible?

The point of not-logging public-key authentication attempts is also the think, that this basically can't be target for any bruteforce attack, since the state space is too large (ex. 1024b key) in comparison to passwords, where you can try all 8 characters passwords (around 64b or entropy max., but usually much less since you can use many heuristics -- vocabulary, only alphabet, and so on). In the keys you have just one large number.

There are logs on RHEL!

On RHEL/CentOS/Fedora you can use the advance of audit, which contains also these failed authentication attempts. You can find them in /var/log/audit/audit.log as USER_AUTH events with res=failed

I hope it will help you a bit.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.