authentication failure log message

From: Greene, Chris (Chris.Greene_at_i-structure.com)
Date: 04/29/04 

Date: Thu, 29 Apr 2004 10:53:29 -0700
To: <secureshell@securityfocus.com>

When I connect to sshd '/var/log/messages' is always updated with:

Apr 29 09:34:18 linux sshd(pam_unix)[1853]: authentication failure;
logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=***.****.***
user=chris
Apr 29 09:34:25 linux sshd(pam_unix)[1855]: session opened for user
chris by (uid=500)

I found this problem in section 3.1 of the FAQ @
http://www.openssh.org/faq.html#3.1

Inside of 'sshd_config' I uncommented out the entry for
'PermitEmptyPasswords' and set it to 'no'

I restarted sshd and still receive the error message.

I really don't care about the message in the log file, but I think it is
causing another problem for me. I've been working on a Perl script
that creates an SSH object that will allow to log into a server and let
me interactively run some commands. As soon as I try to connect I
receive the following:

Permission denied, please try again.
Permission denied, please try again.
Permission denied (publickey,password,keyboard-interactive).

This is without ever even submitting a password. Actually the script
never even detects a password prompt. I know the script is correct.
It has to be something with the way sshd is configured. I'm hoping that
maybe if I can get rid of this "error" message in the log file my
problem will be solved. If I'm already ssh'd to the host and, from the
host, I ssh to the host again, I don't receive this error. Anyone have
any idea as to why I'm still receiving this error message? Thanks.

Relevant Pages

  • Re: ssh2
    ... That's why putty can't detect that there's a problem, because it doesn't have the *correct* values, and so doesn't know that there is now an incorrect host key machine at the end of the socket. ... The worrying thing is that since the sshd now asks for ssh2 protocol only, there is a new sshd operating, one you didn't install, and one which may be copying keystroke data (login names and passwords) to some unauthorized other site. ...
    (Fedora)
  • Re: Voluminous SSHd scanning; possible worm activity?
    ... >> SSHd, I'm recommending that folks utilize IPchains ... > Are we safe if the attack is run from a host not ... tcpd access control files (by default, ... tcpdchk reports problems such as non-existent ...
    (Incidents)
  • Re: Need Help with SSH tunnel over internet
    ... a machine on my lan from some remote machine on the internet. ... On the host that has sshd running, ...
    (alt.os.linux)
  • Re: ssh2
    ... That's why putty can't detect that there's a problem, because it doesn't have the *correct* values, and so doesn't know that there is now an incorrect host key machine at the end of the socket. ... The worrying thing is that since the sshd now asks for ssh2 protocol only, there is a new sshd operating, one you didn't install, and one which may be copying keystroke data to some unauthorized other site. ...
    (Fedora)
  • Re: Hundreds of sshd processes spawned by Postgresql
    ... Has anyone come up with a viable theory as to why outbound connections would be initiated by sshd as opposed to ssh? ... The main question actualy is about important Data on that Host he wants ... tell WHEN the compromise happened. ...
    (Debian-User)