A Linux (specifically Debian Jessie) server that needs to be exposed to the Internet is spitting out various OpenSSH 6.7 preauth
errors in the logs. For example, I'm getting (timestamps elided for clarity):
- error: Received disconnect from A.B.C.D: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]
- fatal: Unable to negotiate a key exchange method [preauth]
- fatal: no matching cipher found: client ... server ... [preauth]
- Received disconnect from A.B.C.D: 11: Normal Shutdown, Thank you for playing [preauth]
- Received disconnect from A.B.C.D: 11: ok [preauth]
and so on.
I'm not terribly worried about the probes themselves; the system is kept up to date, the OpenSSH configuration is fairly well hardened according to current best practice, and there are additional protections (e.g. fail2ban) in place.
Is there any reason why any preauth
OpenSSH log entries would warrant specific human attention?
The answers to the question What does “Normal Shutdown, Thank you for playing [preauth]” In SSH logs mean? indicates that the specific case in that question is safe to ignore; my question is more generic.
preauth
part is the good part: All of that is going on in sandboxed process which does not have any reasonable access to your server. But when you would see some nonstandard messages, that would mean that somebody is playing more than you want (but not necessarily compromise). I would say nothing to worry about. Anyway the question as it is answered by these lines or just too broad ...