SSH log lines

[Matthias Fechner]

Am 03.08.2020 um 21:37 schrieb @lbutlr:
> When some moon tires to login to an account like root, ssh does n’t log the IP address in the failure line as it does with non-existent users.
>
> sshd[99328] error: PAM: Authentication error for root from vps-94314d13.vps.ovh.ca
> sshd[99328] Connection closed by authenticating user root 139.99.236.165 port 46226 [preauth]
>
> sshd[7202] Invalid user pi from 2.232.248.6 port 46438
>
> Is there anyway that I can change this so that the IP address appears not eh same line as the Authentication error, it would make my blacklisting these people much easier.

try fail2ban, it can handle all of this correctly.

Gruß
Matthias

-- 

"Programming today is a race between software engineers striving to
build bigger and better idiot-proof programs, and the universe trying to
produce bigger and better idiots. So far, the universe is winning." --
Rich Cook