When sshd disconnects it leaves a pair of messages:
Received disconnect from NN.NN.NN.NN port 42004:11: disconnected by user : 1
time(s)
Disconnected from NN.NN.NN.NN port 42072 : 1 time(s)
The second message, "Disconnected from" is what this bug report deals
with. The first message, "Received disconnect", was fixed in logwatch
7.4.3, so bionic and newer have this fix but xenial does not.
I've verified that the update in bionic-proposed displays a clean
report:
--------------------- SSHD Begin ------------------------
SSHD Killed: 1 Time(s)
SSHD Started: 2 Time(s)
Failed logins from:
127.0.0.1 (localhost): 1 time
ubuntu/password: 1 time
Users logging in through sshd:
ubuntu:
127.0.0.1 (localhost): 1 time
Received disconnect:
disconnected by user
127.0.0.1 : 1 Time(s)
---------------------- SSHD End -------------------------
And the update in xenial-proposed is correct in that it suppresses the
second message ("Disconnect..."), but the "Received disconnect" message
is still present:
--------------------- SSHD Begin ------------------------
SSHD Killed: 1 Time(s)
SSHD Started: 4 Time(s)
Users logging in through sshd:
ubuntu:
127.0.0.1 (localhost): 1 time
**Unmatched Entries**
Received disconnect from 127.0.0.1 port 50276:11: disconnected by user : 1
time(s)
---------------------- SSHD End -------------------------
So, technically I think the fix can be validated in that it suppresses
the log message as intended. However, a perfect fix for xenial would
also address the additional log message. I think it could either be
left to a follow up or I can respin the xenial portion of this SRU with
the additional fix.
** Tags removed: verification-needed-bionic
** Tags added: verification-done-bionic
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1644057
Title:
Excessive Disconnect unmatched entries from sshd
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/logwatch/+bug/1644057/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
