Since DYNDNS became a payed service, I found a solution to dynamic IP address problem:

OPENWRT router side (dynamic IP, this line is in the CRON):

echo close | ssh LOCATION@SERVER -p 22 > /dev/null 2>&1

SERVER side (with fix IP):

on OpenBSD 5.1 I had nothing to do*

CLIENT side (from where I want to connect to the dynamic IP/OpenWRT router):

vi .bashrc
DYNNAMEHERE01=`ssh root@DOMAINHERE -p PORTHERE "grep 'user DYNNAMEHERE from' /var/log/authlog | tail -1" | sed 's/ from /\n/g' | tail -1 | grep -o "[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*"`
ssh root@"${DYNNAMEHERE01}" -p PORTHERE

and then I just need to use this command:


and I'm in the OpenWRT router as root.

QUESTION: *but with OpenBSD 5.3 the failed login usernames doesn't get logged. Why? I tried to set the SSHD loglevel to DEBUG3 (then: "kill -HUP SSHDPID"), but the failed login usernames weren't logged.

UPDATE: The "LOCATION" is the login name. ( but I tried with "-l" too, it didn't worked )

UPDATE: no, I didn't changed the sshd_config besides:

PermitRootLogin without-password
PubkeyAuthentication yes
PasswordAuthentication no
  • Have you tried using the option -l for the login_name? – Luis May 28 '13 at 11:12
  • ssh LOCATION@SERVER -> LOCATION is the username – gasko peter May 28 '13 at 11:17
  • What is the OpenSSH version you have on the server? – peterph May 30 '13 at 13:11
  • You might also want to check dnslookup.me/dynamic-dns and play with sshd later. – peterph May 30 '13 at 13:11
  • 1
    OpenBSD automatically logs failed logins with ssh users... see my logs: Failed password for invalid user test from port 64832 ssh Did you change how your ssh server is setup? – gabe. May 31 '13 at 13:23

Setting up a custom log for sshd

I realize that there is the default option already setup on OpenBSD for logging so this is an alternative if there is something either broken or mis-configured with that setup!

If you're having an issue with the regular logging facilities included with OpenBSD 5.3 you can override where the logs get sent using the following modification to your sshd_config file:

SyslogFacility LOCAL7

Then configure syslogd to pick up these messages and log them to a separate file:

local7.*     /var/log/local7.log

Be sure to restart the sshd and syslogd services after making the above changes.


If you want something more customizable you might want to give pam_exec a look. More details are in pam_exec man page as well as this tutorial titled: Login notifications, pam_exec scripting.

The idea is simple, create a script such as this one, notify-logins:

[ "$PAM_TYPE" = "open_session" ] || exit 0
  echo "User: $PAM_USER"
  echo "Ruser: $PAM_RUSER"
  echo "Rhost: $PAM_RHOST"
  echo "Service: $PAM_SERVICE"
  echo "TTY: $PAM_TTY"
  echo "Date: `date`"
  echo "Server: `uname -a`"
} | mail -s "`hostname -s` $PAM_SERVICE login: $PAM_USER" root

This script could be adapted to log to a file instead. Next you need to add this script to your pam setup:

auth [default=ignore] pam_exec.so /usr/local/bin/notify-logins

Make sure the script above is executable (chmod +x notify-logins). Figuring out where to put the pam line is probably the hardest part with this method. Here's a decent tutorial that will hopefully get you in the right direction.


A 3rd approach would be to use a tool such as fail2ban which can do a lot more than log failed login attempts. It can react to them in various ways as well. There's a good tutorial here, titled: How to Protect SSH with fail2ban on Ubuntu 12.04. It's geared to Ubuntu but could be adapted for OpenBSD.


  • The solution was: After I upgrade from 5.1 to 5.3 I forgot to update the known_hosts file :) and since the openwrt router had /dev/null I didn't see that. After updating the known_hosts file it works perfectly. :) .. – gasko peter Jun 14 '13 at 9:54
  • Good to know that you solved your issue. I've been bitten myself with changes to the known_hosts files. – slm Jun 14 '13 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.