6

I have the following network topology:

workstation <-> network_device <-> authentication_server

When I log in to network_device from workstation over SSH, then network_device checks with TACACS+ authentication_server if I have a permission to log in, what are my access rights for that network_device, etc. When I execute ssh -o LogLevel=quiet network_device in workstation, then I do not see the network device banner, but I do see the following prompt:

$ ssh -o LogLevel=quiet network_device
TACACS authentication!

Password: 

$ 

This TACACS authentication! string is set by authentication_server. When I execute ssh -vvv -o LogLevel=quiet network_device, then I see that this banner and password prompt seem to have different message IDs. Banner:

debug3: receive packet: type 53                    
debug3: input_userauth_banner                      

*************************************************  
*    Access limited to Authorized Users only    *  
*************************************************  

Password prompt:

debug3: receive packet: type 60                        
debug2: input_userauth_info_req                        
debug2: input_userauth_info_req: num_prompts 1         
TACACS authentication!                           

Password:    

Does OpenSSH client LogLevel option work in a way that it simply filters certain message IDs depending on LogLevel value? Manual page does not explain, how exactly LogLevel decides what to show:

 LogLevel
         Gives the verbosity level that is used when logging messages from ssh(1).  The possible values are: QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3.  The default is
         INFO.  DEBUG and DEBUG1 are equivalent.  DEBUG2 and DEBUG3 each specify higher levels of verbose output.

1 Answer 1

1

The bulk of what you want to know is in log.c in the OpenSSH source. There is an enum variable called log_level. (Enum meaning it acts like a number under the hood, but each level is associated with an easy-to-understand name.) This log_level variable is set globally and acts as a mask for hiding logs you aren't interested in.

Then whenever something is logged, the message is also associated with an importance level, and the message + importance are given to a function called do_log.

In the do_log function, we see the following check:

if (!force && level > log_level)
    return;

It means that if the message is less important than the configured log level, this message is elided from the log output.

The do_log function does additional processing, eg using the importance level of the message to decide whether to prefix the output with fatal or whatever is appropriate.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .