[Bug 501956] Re: OpenSSH does not log failed attempts when key authentication is used

[Kees Cook]

** Branch linked: lp:~kees/openssh/report-publickey

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to openssh in Ubuntu.
https://bugs.launchpad.net/bugs/501956

Title:
  OpenSSH does not log failed attempts when key authentication is used

Status in Portable OpenSSH:
  Unknown
Status in “openssh” package in Ubuntu:
  Confirmed

Bug description:
  ========================================================
  Description:	Ubuntu 9.10
  Release:	9.10
  openssh-server:
    Installed: 1:5.1p1-6ubuntu2
    Candidate: 1:5.1p1-6ubuntu2
    Version table:
   *** 1:5.1p1-6ubuntu2 0
          500 http://us.archive.ubuntu.com karmic/main Packages
          100 /var/lib/dpkg/status
  ========================================================

  If you disable password authentication in sshd_config
  (PasswordAuthentication no) and attempt to log in with an incorrect
  key, a failed login attempt entry should appear in auth.log, as it
  does with username/password authentication.  Nothing is logged though.

  If you change "LogLevel INFO" to "VERBOSE" in /etc/ssh/sshd_config you
  do get an entry as below but it isn't enough to indicate a potential
  issue :

  "Dec 31 18:17:33 localhost sshd[8011]: Connection from 82.23.xx.yy
  port 38583"

To manage notifications about this bug go to:
https://bugs.launchpad.net/openssh/+bug/501956/+subscriptions