On Fri, 3 Jan 2014, Bob Proulx wrote: > I am always hesitant to mention version numbers upstream because I am > using a software distribution and as you know software distributions > support a single release for the lifetime of the distro's stable > release. I am running Debian Stable on my internet facing machines. > For Debian it is about two years. For me this is perfect. > > In private mail I had someone point me to this serverfault question. > Apparently I was not the only one who noticed this change and was > asking questions about it. (shrug) > > http://serverfault.com/questions/559200/what-does-normal-shutdown-thank-you-for-playing-preauth-in-ssh-logs-mean > > And the answer proposed seems reasonable. That the disconnect message > wasn't logged by sshd previously and now it is being logged. In your > upstream sources this could have been a change any time in the last > two years. I only made the upgrade on my machines last summer from a > 5.x release to a 6.x release. I have been noticing these for some > months but just finally decided to ask about it. The message has been there basically forever: 1.41 (markus 02-Jan-01): log("Received disconnect from %s: %d: %.400s", ... The only thing to have changed semi-recently is that we improved logging of preauthentication messages in privsep mode in the 5.9 release to no longer need a /dev/log inside the privsep chroot. If your old OpenSSH version was <5.9 and the /var/empty chroot didn't have a /dev/log in it then you may have been missing these messages. -d
