0

The log on my server is full of entries like these:

input_userauth_request: invalid user dennis [preauth]
Received disconnect from xxx.xxx.xxx.xxx: 11: Bye Bye [preauth]
Invalid user park from xxx.xxx.xxx.xxx
input_userauth_request: invalid user park [preauth]
Received disconnect from xxx.xxx.xxx.xxx: 11: Bye Bye [preauth]
Invalid user stu from xxx.xxx.xxx.xxx
input_userauth_request: invalid user stu [preauth]
Received disconnect from xxx.xxx.xxx.xxx: 11: Bye Bye [preauth]
Invalid user diego from xxx.xxx.xxx.xxx
input_userauth_request: invalid user diego [preauth]
Received disconnect from xxx.xxx.xxx.xxx: 11: Bye Bye [preauth]
Invalid user deploy from xxx.xxx.xxx.xxx
input_userauth_request: invalid user deploy [preauth]
Received disconnect from xxx.xxx.xxx.xxx: 11: Bye Bye [preauth]

I have disabled password authentication in sshd config.

I tried to replicate to connection attempt with the following command and no such log entry was written for randomuser (I get Permission denied (publickey)):

ssh -o PreferredAuthentications=keyboard-interactive -o PubkeyAuthentication=no randomuser@server.com

I am wondering how these login attempts are being made?

0

I believe that the way that the script that is making the connections is not the same way as you're making a connection when attempting on the command line. I assume that it is not an interactive request being made on that command line by a user/bot rather the entire authentication request is being sent in one request (ip address, username, password).

The SSH daemon probably doesn't like how the connection requests are being made (as everything all together as opposed to interactive) so is dropping the connection them based on that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.