My ssh daemon is setup to listen on port 2221. I have also disabled root login from ssh.

I don't understand why in auth.log I see attempts to log on other ports (example with 4627 here).

May 17 15:36:04 srv01 sshd[21682]: PAM service(sshd) ignoring max retries; 6 > 3
May 17 15:36:08 srv01 sshd[21706]: User root from 218.10.19.134 not allowed because none of user's groups are listed in AllowGroups
May 17 15:36:08 srv01 sshd[21706]: input_userauth_request: invalid user root [preauth]
May 17 15:36:10 srv01 sshd[21706]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.10.19.134  user=root
May 17 15:36:12 srv01 sshd[21706]: Failed password for invalid user root from 218.10.19.134 port 4627 ssh2
May 17 15:36:15 srv01 sshd[21706]: Failed password for invalid user root from 218.10.19.134 port 4627 ssh2
May 17 15:36:17 srv01 sshd[21706]: Failed password for invalid user root from 218.10.19.134 port 4627 ssh2
May 17 15:36:19 srv01 sshd[21706]: Failed password for invalid user root from 218.10.19.134 port 4627 ssh2
May 17 15:36:24 srv01 sshd[21706]: Failed password for invalid user root from 218.10.19.134 port 4627 ssh2
May 17 15:36:27 srv01 sshd[21706]: Failed password for invalid user root from 218.10.19.134 port 4627 ssh2
May 17 15:36:27 srv01 sshd[21706]: Disconnecting: Too many authentication failures for root [preauth]

SSHD is supposed to take these tries into account. Why do the logs say user/password is not matching whereas it shouldn't receive the request (wrong port)? Am I missing something?

up vote 11 down vote accepted

The logs tell you:

Someone with the IP 218.10.19.134 and from port 4627 was trying several times to login as user root with a password. But:

  • user root is invalid anyway, the logs is just informing you of the login attempts
  • the attempted login method was password authentication (not public key or anything else)
  • the source port was 4627, the destination port was 2221 (not written into the logs, as sshd is only listening to 2221, any other attempts on other ports aren’t noticed by sshd)
  • after some attempts, sshd blocked login by disconnecting the tcp connection

You’ll find all the highlighted words of my answer in your logs, except for the 2221.

  • 1
    Thanks for this answer, I will disable password authentication to deal with keys. – iwalktheline May 20 '14 at 11:42

The port number given in the log is the port on the client side, not on yours.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.