I have the following network topology:

workstation <-> network_device <-> authentication_server

When I log in to network_device from workstation over SSH, then network_device checks with TACACS+ authentication_server if I have a permission to log in, what are my access rights for that network_device, etc. When I execute ssh -o LogLevel=quiet network_device in workstation, then I do not see the network device banner, but I do see the following prompt:

$ ssh -o LogLevel=quiet network_device
TACACS authentication!



This TACACS authentication! string is set by authentication_server. When I execute ssh -vvv -o LogLevel=quiet network_device, then I see that this banner and password prompt seem to have different message IDs. Banner:

debug3: receive packet: type 53                    
debug3: input_userauth_banner                      

*    Access limited to Authorized Users only    *  

Password prompt:

debug3: receive packet: type 60                        
debug2: input_userauth_info_req                        
debug2: input_userauth_info_req: num_prompts 1         
TACACS authentication!                           


Does OpenSSH client LogLevel option work in a way that it simply filters certain message IDs depending on LogLevel value? Manual page does not explain, how exactly LogLevel decides what to show:

         Gives the verbosity level that is used when logging messages from ssh(1).  The possible values are: QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3.  The default is
         INFO.  DEBUG and DEBUG1 are equivalent.  DEBUG2 and DEBUG3 each specify higher levels of verbose output.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.