Re: sshd logging with key-only authentication

2010-07-09 Thread Glen Barber
On 7/8/10 11:13 PM, David Adam wrote: On Thu, 8 Jul 2010, Glen Barber wrote: On 7/8/10 10:24 PM, David Adam wrote: On Thu, 8 Jul 2010, Glen Barber wrote: What caught my interest is if I attempt to log in from a machine where I do not have my key or an incorrect key, I see nothing logged in au

Re: sshd logging with key-only authentication

2010-07-08 Thread David Wolfskill
On Thu, Jul 08, 2010 at 07:42:15PM -0400, Glen Barber wrote: > ... > What caught my interest is if I attempt to log in from a machine where I > do not have my key or an incorrect key, I see nothing logged in auth.log > about a failed login attempt. If I attempt with an invalid username, as > e

Re: sshd logging with key-only authentication

2010-07-08 Thread David Adam
On Thu, 8 Jul 2010, Glen Barber wrote: > On 7/8/10 10:24 PM, David Adam wrote: > > On Thu, 8 Jul 2010, Glen Barber wrote: > > > What caught my interest is if I attempt to log in from a machine > > > where I do not have my key or an incorrect key, I see nothing logged > > > in auth.log about a fa

Re: sshd logging with key-only authentication

2010-07-08 Thread David Adam
On Thu, 8 Jul 2010, Glen Barber wrote: > I've been seeing quite a bit of ssh bruteforce attacks which appear to be > dictionary-based. That's fine; I have proper measures in place, such as > key-only access, bruteforce tables for PF, and so on; though some of the > attacks are delaying login attem

Re: sshd logging with key-only authentication

2010-07-08 Thread Glen Barber
On 7/8/10 10:24 PM, David Adam wrote: On Thu, 8 Jul 2010, Glen Barber wrote: I've been seeing quite a bit of ssh bruteforce attacks which appear to be dictionary-based. That's fine; I have proper measures in place, such as key-only access, bruteforce tables for PF, and so on; though some of the

sshd logging with key-only authentication

2010-07-08 Thread Glen Barber
Hi, I've been seeing quite a bit of ssh bruteforce attacks which appear to be dictionary-based. That's fine; I have proper measures in place, such as key-only access, bruteforce tables for PF, and so on; though some of the attacks are delaying login attempts, bypassing the bruteforce rules,