Bug 218925 - 800.loginfail needs more info on some ssh login failures
Summary: 800.loginfail needs more info on some ssh login failures
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: 11.0-STABLE
Hardware: Any Any
: --- Affects Many People
Assignee: freebsd-bugs (Nobody)
URL:
Keywords: patch
Depends on:
Blocks:
 
Reported: 2017-04-28 04:20 UTC by Daniel McRobb
Modified: 2017-04-28 05:25 UTC (History)
0 users

See Also:

Attachments
patch to pick up more useful ssh login failure data from auth.log (504 bytes, patch)
2017-04-28 04:20 UTC, Daniel McRobb 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Daniel McRobb 2017-04-28 04:20:07 UTC 
Created attachment 182143 [details]
patch to pick up more useful ssh login failure data from auth.log

I regularly get this kind of mail from the daily security run on public-facing machines:

Apr 26 06:00:50 ria sshd[31509]: Disconnecting: Too many authentication failures [preauth]
Apr 26 06:49:03 ria sshd[31583]: Disconnecting: Too many authentication failures [preauth]
Apr 26 06:56:49 ria sshd[31627]: Disconnecting: Too many authentication failures [preauth]
Apr 26 07:45:25 ria sshd[31715]: Disconnecting: Too many authentication failures [preauth]
Apr 26 09:28:19 ria sshd[31890]: Disconnecting: Too many authentication failures [preauth]
Apr 26 09:59:13 ria sshd[31952]: Disconnecting: Too many authentication failures [preauth]
Apr 26 11:16:29 ria sshd[32092]: Disconnecting: Too many authentication failures [preauth]
Apr 26 12:52:50 ria sshd[32457]: Disconnecting: Too many authentication failures [preauth]
Apr 26 15:29:09 ria sshd[33415]: Disconnecting: Too many authentication failures [preauth]

Not very helpful.  I should be seeing this:

Apr 26 06:00:50 ria sshd[31509]: error: maximum authentication attempts exceeded for root from 188.187.52.118 port 49171 ssh2 [preauth]
Apr 26 06:00:50 ria sshd[31509]: Disconnecting: Too many authentication failures [preauth]
Apr 26 06:49:03 ria sshd[31583]: error: maximum authentication attempts exceeded for root from 87.198.39.108 port 45609 ssh2 [preauth]
Apr 26 06:49:03 ria sshd[31583]: Disconnecting: Too many authentication failures [preauth]
Apr 26 06:56:49 ria sshd[31627]: error: maximum authentication attempts exceeded for root from 190.216.171.66 port 39053 ssh2 [preauth]
Apr 26 06:56:49 ria sshd[31627]: Disconnecting: Too many authentication failures [preauth]
Apr 26 07:45:25 ria sshd[31715]: error: maximum authentication attempts exceeded for root from 62.20.61.178 port 40532 ssh2 [preauth]
Apr 26 07:45:25 ria sshd[31715]: Disconnecting: Too many authentication failures [preauth]
Apr 26 09:28:19 ria sshd[31890]: error: maximum authentication attempts exceeded for root from 112.250.104.128 port 43618 ssh2 [preauth]
Apr 26 09:28:19 ria sshd[31890]: Disconnecting: Too many authentication failures [preauth]
Apr 26 09:59:13 ria sshd[31952]: error: maximum authentication attempts exceeded for root from 202.100.182.254 port 54912 ssh2 [preauth]
Apr 26 09:59:13 ria sshd[31952]: Disconnecting: Too many authentication failures [preauth]
Apr 26 11:16:29 ria sshd[32092]: error: maximum authentication attempts exceeded for root from 71.227.146.158 port 60455 ssh2 [preauth]
Apr 26 11:16:29 ria sshd[32092]: Disconnecting: Too many authentication failures [preauth]
Apr 26 12:52:50 ria sshd[32457]: error: maximum authentication attempts exceeded for root from 77.37.232.131 port 39678 ssh2 [preauth]
Apr 26 12:52:50 ria sshd[32457]: Disconnecting: Too many authentication failures [preauth]
Apr 26 15:29:09 ria sshd[33415]: error: maximum authentication attempts exceeded for root from 78.194.25.54 port 49924 ssh2 [preauth]
Apr 26 15:29:09 ria sshd[33415]: Disconnecting: Too many authentication failures [preauth]

Even better would be:

Apr 26 06:00:50 ria sshd[31509]: error: maximum authentication attempts exceeded for root from 188.187.52.118 port 49171 ssh2 [preauth]
Apr 26 06:49:03 ria sshd[31583]: error: maximum authentication attempts exceeded for root from 87.198.39.108 port 45609 ssh2 [preauth]
Apr 26 06:56:49 ria sshd[31627]: error: maximum authentication attempts exceeded for root from 190.216.171.66 port 39053 ssh2 [preauth]
Apr 26 07:45:25 ria sshd[31715]: error: maximum authentication attempts exceeded for root from 62.20.61.178 port 40532 ssh2 [preauth]
Apr 26 09:28:19 ria sshd[31890]: error: maximum authentication attempts exceeded for root from 112.250.104.128 port 43618 ssh2 [preauth]
Apr 26 09:59:13 ria sshd[31952]: error: maximum authentication attempts exceeded for root from 202.100.182.254 port 54912 ssh2 [preauth]
Apr 26 11:16:29 ria sshd[32092]: error: maximum authentication attempts exceeded for root from 71.227.146.158 port 60455 ssh2 [preauth]
Apr 26 12:52:50 ria sshd[32457]: error: maximum authentication attempts exceeded for root from 77.37.232.131 port 39678 ssh2 [preauth]
Apr 26 15:29:09 ria sshd[33415]: error: maximum authentication attempts exceeded for root from 78.194.25.54 port 49924 ssh2 [preauth]

A minor change (attached) will at least get the lines that are useful (and also the cruft but I can live with that), and I don't believe it will muck up the recognition of other login failures.