SSH log lines

Matthias Fechner idefix at
Tue Aug 4 05:22:50 UTC 2020

Am 03.08.2020 um 21:37 schrieb @lbutlr:
> When some moon tires to login to an account like root, ssh does n’t log the IP address in the failure line as it does with non-existent users.
> sshd[99328] error: PAM: Authentication error for root from
> sshd[99328] Connection closed by authenticating user root port 46226 [preauth]
> sshd[7202] Invalid user pi from port 46438
> Is there anyway that I can change this so that the IP address appears not eh same line as the Authentication error, it would make my blacklisting these people much easier.

try fail2ban, it can handle all of this correctly.



"Programming today is a race between software engineers striving to
build bigger and better idiot-proof programs, and the universe trying to
produce bigger and better idiots. So far, the universe is winning." --
Rich Cook

More information about the freebsd-questions mailing list