modern syslog daemons (including rsyslog, which is default on just about every
linux system) allow you to filter efficiently on the message contents, not just
the severity, so you can opt to throw out the messages you don't want.
I advocate for a slightly different way of dealing with it, filter these
messages from your main logstream, but put them into either a script directly,
or a separate file and have a script run against it. Have the script report the
number of these messgaes that you get in a time period (minute, hour, whatever
you want) and log that count back into your log stream
as Marcus Ranum said in his Artificial Ignorance writeup, the number of times
that an uninteresting thing happens can be interesting.
If you see a big spike (or drop) is these attempts, it can indicate cause for
concern.
David Lang
On Sat,
18 Mar 2023, Carsten Andrich wrote:
Date: Sat, 18 Mar 2023 13:15:29 +0100
From: Carsten Andrich <carsten.andrich@xxxxxxxxxxxxx>
To: openssh-unix-dev@xxxxxxxxxxx
Subject: Minimize sshd log clutter/spam from unauthenticated connections
Dear OpenSSH developers,
a publicly accessible sshd on port 22 generates a lot of log clutter from
unauthenticated connections. For an exemplary host on a university network,
sshd accumulates 5~20k log lines on a single day (more than 90% of the total
amount of syslog lines). That is despite the host having a restricted
configuration (no SSH password authentication, firewall rate limit for new
SSH connections on /24 subnets permitting a few connections per hour, however
with a shorter timeout). I'd expect even more log messages for a default
configuration (password auth enabled and no firewall rate limit).
Would you be open to introducing a new config option to suppress any log
messages from yet unauthenticated connections? If such a suggestion has been
discussed before, please direct me to it. I haven't found anything in the
archives.
Any log messages including successful authentication and afterwards are still
desired, so changing the log level to above INFO will not help. Additionally,
even unauthenticated connections cause messages with levels ERROR
("kex_exchange_identification: Connection closed by remote host") or even
CRITICAL ("Timeout before authentication"). As I periodically scan my hosts'
syslogs for messages with level WARNING or above, I currently have to filter
these messages to keep my inbox from overflowing.
Thanks and best regards,
Carsten
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@xxxxxxxxxxx
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@xxxxxxxxxxx
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
