1

When taking a look into my /var/log/secure logging file, I'm able to see attempts to log into my CentOS system via SSH, however, the username is blank. I've recreated this myself by entering false usernames, but the log still shows it being blank.

Feb 11 15:40:02 centos sshd[15369]: Invalid user  from xxx.181.90.221 port 51474
Feb 11 15:40:48 centos sshd[15394]: Invalid user  from xxx.181.90.221 port 51514
Feb 11 15:40:57 centos sshd[15396]: Invalid user  from xxx.181.90.221 port 51526
Feb 11 15:49:15 centos sshd[15462]: Invalid user  from xxx.181.90.221 port 51933
Feb 11 15:49:24 centos sshd[15464]: Invalid user  from xxx.181.90.221 port 51941
Feb 11 15:49:31 centos sshd[15466]: Invalid user  from xxx.181.90.221 port 51948
Feb 11 15:58:55 centos sshd[15622]: Invalid user  from xxx.181.90.221 port 52415
Feb 11 15:59:02 centos sshd[15624]: Invalid user  from xxx.181.90.221 port 52422
Feb 11 15:59:08 centos sshd[15626]: Invalid user  from xxx.181.90.221 port 52427
Feb 11 16:05:13 centos sshd[15684]: Invalid user  from xxx.181.90.221 port 52723
Feb 11 16:05:37 centos sshd[15688]: Invalid user  from xxx.181.90.221 port 52741
Feb 11 16:15:10 centos sshd[15776]: Invalid user  from xxx.181.90.221 port 53203
Feb 11 16:19:23 centos sshd[3862]: Invalid user  from xxx.181.90.221 port 53410

Any idea on how I could get this to provided the attempted username? This seemed to start happening after I set up Fail2Ban.

Thanks!

EDIT: It looks as though it will only log the usernames that are attempted from an internal IP address. Any external IP address will not log the username. Here is an external address trying to connect:

Feb 11 16:19:23 centos sshd[3862]: Invalid user  from xxx.181.90.221 port 53410

and here it is from an internal IP:

Feb 11 19:12:33 centos sshd[4193]: Invalid user badusername from 192.168.1.10 port 1718
  • fail2ban doesn't alter any of the logging processes. It simply reads the logs that get generated. If the format really did change then something else is responsible. (Do you have any evidence to confirm that the log file used to include the username?) – roaima Feb 12 at 0:51
  • Yes, earlier before I installed fail2ban and set the ssh logpath as /var/log/secure, it logged user names. Feb 11 12:39:54 centos sshd[15331]: Invalid user admin from xx.xx.xx.xx port 51285 – veanome Feb 12 at 1:04
  • It also looks as though if I connect to my centos box from the internal IP address it will log the username, but if its an external IP address it will not log the username. – veanome Feb 12 at 1:11
  • Sure! I went ahead and made the edits. I'm going to do another restart of the CentOS machine and see if that may fix anything. – veanome Feb 12 at 14:58
  • 1
    The username used could actually have been empty or a space or tab, possibly in an attempt to confuse or bypass security (which didn't work on your system obviously). – Kusalananda Feb 12 at 15:01
1

fail2ban itself doesn't alter any of the logging processes. It simply reads the logs that get generated. However, I can reproduce the issue as described by specifying a null username:

ssh -l '' remote_host

The corresponding log entries in /var/log/auth.log on my Debian server are

Feb 12 16:35:43 remote_host sshd[6738]: Invalid user  from 192.168.xx.yy port 26677
Feb 12 16:35:43 remote_host sshd[6738]: input_userauth_request: invalid user  [preauth]

Looking closely you can see the double space between user and from in that first line, as seen in your own logs.

  • 1
    I was able to get around to my testing. It looks like I'm able to log the username attempts now from both internal and external IP addresses. I'm guessing the username being entered in was just a space or empty as @Kusalananda suggested. Thanks for the help everyone! – veanome Feb 12 at 17:22
  • Based on my testing, if the username had been a space you'd have got three adjacent spaces in the log message. – roaima Feb 12 at 19:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.