If SSH root login is disabled, why does auth.log keep track of all the failed attempts and thus causing the admin more data to wade through? Can I disable this behaviour? Can I redirect those failed attempts into another file, as the attempts are not really a concern anymore? Blocking the IPs via firewall would prevent them from appearing, I'm aware, but blocking IPs is silly as a long term solution as it prevents genuine requests since an IP doesn't represent a single host in many cases.

| improve this question | | | | |

auth is the default SysLogFacility for sshd (openssh).

The authors choose to log attemts althouh prohibited. This is along normal logging behviour: If something does NOT work, log it.

As there is no specific log switch for failed root logins within sshd you have tp tune that on syslog level.

Configure syslog in the auth facility to ignore failed root login messages coming from sshd.

| improve this answer | | | | |

Attempts to log in as root on your server are an indication of an intrusion attempt. The defaults are set up in line with information security best practice, so that admins are aware when someone is trying to access their servers as root.

Ignoring failed root logons runs counter to best practice. If you do not want to see the failed root logon entries in the security log, configure syslog to send them somewhere else.

| improve this answer | | | | |
  • These best practices do they say what else I can do in addition to disabling ssh root logins? Banning the IPs may prevent legitimate requests so that isnt a valid option. – Bojan Landekić Aug 24 '16 at 18:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.