[Bug 965654] [NEW] /var/log/auth spam every 2 mins: sshd[*]: Connection closed by 127.0.0.1 [preauth]

[JP Vossen]

Public bug reported:

Description:	Ubuntu precise (development branch)
Release:	12.04

openssh-server-1:5.9p1-4ubuntu1

Not really sure that OpenSSH is the real culprit, but it's what has been
reporting the log spam since I upgraded from 10.10 to 12.04 a day or two
ago:

$ sudo grep 'Connection closed by 127.0.0.1' /var/log/auth.log | tail
Mar 26 14:27:19 perry2 sshd[16380]: Connection closed by 127.0.0.1 [preauth]
Mar 26 14:29:19 perry2 sshd[16383]: Connection closed by 127.0.0.1 [preauth]
Mar 26 14:31:19 perry2 sshd[26767]: Connection closed by 127.0.0.1 [preauth]
Mar 26 14:33:19 perry2 sshd[7300]: Connection closed by 127.0.0.1 [preauth]
Mar 26 14:35:19 perry2 sshd[19270]: Connection closed by 127.0.0.1 [preauth]
Mar 26 14:37:19 perry2 sshd[31926]: Connection closed by 127.0.0.1 [preauth]
Mar 26 14:39:19 perry2 sshd[1696]: Connection closed by 127.0.0.1 [preauth]
Mar 26 14:41:19 perry2 sshd[1700]: Connection closed by 127.0.0.1 [preauth]
Mar 26 14:43:19 perry2 sshd[1703]: Connection closed by 127.0.0.1 [preauth]
Mar 26 14:45:19 perry2 sshd[1709]: Connection closed by 127.0.0.1 [preauth]

$ sudo zgrep -c 'Connection closed by 127.0.0.1' /var/log/auth.log*
/var/log/auth.log:934
/var/log/auth.log.1:595
/var/log/auth.log.2.gz:0
/var/log/auth.log.3.gz:0
/var/log/auth.log.4.gz:0

$ ll /var/log/auth.log*
-rw-r----- 1 syslog adm 128K Mar 26 14:52 /var/log/auth.log
-rw-r----- 1 syslog adm 132K Mar 25 07:52 /var/log/auth.log.1
-rw-r----- 1 syslog adm 2.1K Mar 23 16:25 /var/log/auth.log.2.gz
-rw-r----- 1 syslog adm  18K Feb 26 07:45 /var/log/auth.log.3.gz
-rw-r----- 1 syslog adm  19K Feb 19 07:45 /var/log/auth.log.4.gz

** Affects: openssh (Ubuntu)
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to openssh in Ubuntu.
https://bugs.launchpad.net/bugs/965654

Title:
  /var/log/auth spam every 2 mins: sshd[*]: Connection closed by
  127.0.0.1 [preauth]

Status in “openssh” package in Ubuntu:
  New

Bug description:
  Description:	Ubuntu precise (development branch)
  Release:	12.04

  openssh-server-1:5.9p1-4ubuntu1

  Not really sure that OpenSSH is the real culprit, but it's what has
  been reporting the log spam since I upgraded from 10.10 to 12.04 a day
  or two ago:

  $ sudo grep 'Connection closed by 127.0.0.1' /var/log/auth.log | tail
  Mar 26 14:27:19 perry2 sshd[16380]: Connection closed by 127.0.0.1 [preauth]
  Mar 26 14:29:19 perry2 sshd[16383]: Connection closed by 127.0.0.1 [preauth]
  Mar 26 14:31:19 perry2 sshd[26767]: Connection closed by 127.0.0.1 [preauth]
  Mar 26 14:33:19 perry2 sshd[7300]: Connection closed by 127.0.0.1 [preauth]
  Mar 26 14:35:19 perry2 sshd[19270]: Connection closed by 127.0.0.1 [preauth]
  Mar 26 14:37:19 perry2 sshd[31926]: Connection closed by 127.0.0.1 [preauth]
  Mar 26 14:39:19 perry2 sshd[1696]: Connection closed by 127.0.0.1 [preauth]
  Mar 26 14:41:19 perry2 sshd[1700]: Connection closed by 127.0.0.1 [preauth]
  Mar 26 14:43:19 perry2 sshd[1703]: Connection closed by 127.0.0.1 [preauth]
  Mar 26 14:45:19 perry2 sshd[1709]: Connection closed by 127.0.0.1 [preauth]

  $ sudo zgrep -c 'Connection closed by 127.0.0.1' /var/log/auth.log*
  /var/log/auth.log:934
  /var/log/auth.log.1:595
  /var/log/auth.log.2.gz:0
  /var/log/auth.log.3.gz:0
  /var/log/auth.log.4.gz:0

  $ ll /var/log/auth.log*
  -rw-r----- 1 syslog adm 128K Mar 26 14:52 /var/log/auth.log
  -rw-r----- 1 syslog adm 132K Mar 25 07:52 /var/log/auth.log.1
  -rw-r----- 1 syslog adm 2.1K Mar 23 16:25 /var/log/auth.log.2.gz
  -rw-r----- 1 syslog adm  18K Feb 26 07:45 /var/log/auth.log.3.gz
  -rw-r----- 1 syslog adm  19K Feb 19 07:45 /var/log/auth.log.4.gz

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/965654/+subscriptions