[Bug 234793] Failed unknown for $USER in sshd logs even if I got authenticated

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=234793

Jamie Baxter <jamie.baxter at tutanota.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jamie.baxter at tutanota.com

--- Comment #14 from Jamie Baxter <jamie.baxter at tutanota.com> ---
Seeing the same issue here on all FreeBSD 12.0 machines. Seeing 3 "Failed
unknown for $USER from $IP port $PORT ssh2" strings on each connection showing
up in auth.log at VERBOSE level or higher.

Three machines were updated from 11.2 -> 12.0 and all demonstrate this
behavior. It also occurs with a new machine that installed 12.0 fresh. Had to
disable sshguard on all machines until I found the number of failures in
auth.log (they all locked me out after upgrade, and the new 12.0 installation
locked me out after sshguard was started).

(In reply to Thomas Guymer from comment #9)
(In reply to Peter Putzer from comment #10)

With regard to sshguard problems, you should be able to get circumvent this by
adjusting THRESHOLD in sshguard.conf to some value higher than 30 (if you
utilize BLACKLIST_FILE, also ensure that threshold is raised to match). Do
ensure your client IP is not already committed to any blacklist sshguard may
use.

-- 
You are receiving this mail because:
You are the assignee for the bug.