Bug 240356

Summary:	sshd Connection closed by 127.0.0.1 port ???
Product:	Base System	Reporter:	Aleks <Z462vasa>
Component:	kern	Assignee:	freebsd-bugs (Nobody) <bugs>
Status:	Closed Works As Intended
Severity:	Affects Only Me	CC:	emaste
Priority:	---
Version:	12.0-STABLE
Hardware:	Any
OS:	Any

Description Aleks 2019-09-05 17:41:38 UTC

Aug 28 10:20:46  sshd[98971]: Connection closed by 127.0.0.1 port 43986 [preauth]
Aug 28 10:25:47  sshd[99050]: Connection closed by 127.0.0.1 port 44014 [preauth]
Aug 28 10:30:47  sshd[99155]: Connection closed by 127.0.0.1 port 44061 [preauth]
Aug 28 10:35:46  sshd[99232]: Connection closed by 127.0.0.1 port 44090 [preauth]
Aug 28 10:40:46  sshd[99340]: Connection closed by 127.0.0.1 port 44139 [preauth]
Aug 28 10:45:46  sshd[99419]: Connection closed by 127.0.0.1 port 44169 [preauth]
Aug 28 10:50:47  sshd[99514]: Connection closed by 127.0.0.1 port 44211 [preauth]
Aug 28 10:55:46  sshd[99591]: Connection closed by 127.0.0.1 port 44240 [preauth]
Aug 28 11:00:46  sshd[99731]: Connection closed by 127.0.0.1 port 44304 [preauth]
Aug 28 11:05:46  sshd[99811]: Connection closed by 127.0.0.1 port 44350 [preauth]
Aug 28 11:10:46  sshd[99911]: Connection closed by 127.0.0.1 port 44389 [preauth]

Comment 1 Ed Maste freebsd_committer

2019-11-20 14:56:31 UTC

sshd is just logging that you have something connecting to the ssh port, and then disconnecting before authentication. If you want to avoid this message you'll need to find out what is making the connection and stop it from doing so.

A quick Google search suggests Nagios ssh check might have this behaviour - see https://support.microfocus.com/kb/doc.php?id=7014539