audit records

[Andrew Thompson]

Hi,


I thought i'd try out the new audit system and simulate an invalid login.
I was suprised to see that ssh connections to localhost show up as
255.255.255.255, is this an error?

% ssh df at localhost
header,94,10,OpenSSH login,0,Fri Nov 17 12:16:44 2006, + 100 msec
subject,-1,-1,-1,-1,-1,1378,1378,60666,255.255.255.255
text,invalid user name "df"
return,failure : No such process,4294967295
trailer,94

% ssh df at 192.168.0.182
header,95,10,OpenSSH login,0,Fri Nov 17 12:17:26 2006, + 892 msec
subject,-1,-1,-1,-1,-1,1385,1385,58511,192.168.0.182
text,invalid user name "df"
return,failure : No such process,4294967295
trailer,95



Andrew