A Linux (specifically Debian Jessie) server that needs to be exposed to the Internet is spitting out various OpenSSH 6.7
preauth errors in the logs. For example, I'm getting (timestamps elided for clarity):
- error: Received disconnect from A.B.C.D: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]
- fatal: Unable to negotiate a key exchange method [preauth]
- fatal: no matching cipher found: client ... server ... [preauth]
- Received disconnect from A.B.C.D: 11: Normal Shutdown, Thank you for playing [preauth]
- Received disconnect from A.B.C.D: 11: ok [preauth]
and so on.
I'm not terribly worried about the probes themselves; the system is kept up to date, the OpenSSH configuration is fairly well hardened according to current best practice, and there are additional protections (e.g. fail2ban) in place.
Is there any reason why any
preauth OpenSSH log entries would warrant specific human attention?
The answers to the question What does “Normal Shutdown, Thank you for playing [preauth]” In SSH logs mean? indicates that the specific case in that question is safe to ignore; my question is more generic.