1

My auth.log to contains these two kinds of entries for ssh: These

Jun 27 07:28:25 myhost sshd[26898]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=some.ip.address.123 user=git

and these

Jun 20 21:46:18 myhost sshd[13881]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=some.ip.address.234

As you can see the second kind does not include a "user=" field. Otherwise they have the same format. What does that mean? Is it possible to attempt ssh login without a username?

  • You can go for ssh login without specifing username if the machine on which you are trying to ssh has the same username as your local machine. – Bhavya Jain Jul 6 '17 at 12:13
  • But shouldn't ruser be set in this case? Where can I find a description of the output? – Franklin Jul 6 '17 at 12:18
2

Lines without ruser are written if the provided user is invalid on your system (try with ssh whateverthereisnot@localhost).

Unknown usernames are usually not recorded in logs because these might be usernames for a different system (accidental login attempt to the wrong machine), or worse, passwords (accidentally typed in the username field).

  • Wait, what is ruser and what is user? – Franklin Jul 7 '17 at 7:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.