codehosting ssh access log "failed to authenticate" does not include username

[Andrew Bennetts]

The codehosting ssh daemon's access log is generally quite nice, but its "failed to authenticate" messages don't include the username. It would be nice to know the username so that we can know how many different users are failing to connect (or if it is the same user over and over), have more clues when debugging problems, etc.

[John A Meinel (jameinel)]

I'm pretty sure this is a launchpad-side thing, not a bzr side thing. We might assign it to the bzr team if we decide to work on it.

[Michael Hudson-Doyle (mwhudson)]

I think this might be a little tricky to achieve, sadly.

The failed to authenticate message is produced when the client disconnects without authenticating. Which usernames were presented is known by the "UserDetailsMind" object, which is attached to the SSHUserAuthServer object. So I guess we need to somehow record on the transport passed to SSHUserAuthServer.__init__ the usernames that have been recorded, and read them out again in lp.services.sshserver.service.Factory.connectionLost (maybe a WeakKeyDict mapping transports to lists of usernames?)

HTH!

[Martin Pool (mbp)]

On 19 January 2011 19:29, Michael Hudson-Doyle
<email address hidden> wrote:
> I think this might be a little tricky to achieve, sadly.
>
> The failed to authenticate message is produced when the client
> disconnects without authenticating.  Which usernames were presented is
> known by the "UserDetailsMind" object, which is attached to the
> SSHUserAuthServer object.  So I guess we need to somehow record on the
> transport passed to SSHUserAuthServer.__init__ the usernames that have
> been recorded, and read them out again in
> lp.services.sshserver.service.Factory.connectionLost (maybe a
> WeakKeyDict mapping transports to lists of usernames?)

Couldn't we just log them at the time the username is sent, and then
later log that the same client disconnected?

--
Martin

[Michael Hudson-Doyle (mwhudson)]

On Fri, 21 Jan 2011 00:08:30 -0000, Martin Pool <email address hidden> wrote:
> On 19 January 2011 19:29, Michael Hudson-Doyle
> <email address hidden> wrote:
> > I think this might be a little tricky to achieve, sadly.
> >
> > The failed to authenticate message is produced when the client
> > disconnects without authenticating.  Which usernames were presented is
> > known by the "UserDetailsMind" object, which is attached to the
> > SSHUserAuthServer object.  So I guess we need to somehow record on the
> > transport passed to SSHUserAuthServer.__init__ the usernames that have
> > been recorded, and read them out again in
> > lp.services.sshserver.service.Factory.connectionLost (maybe a
> > WeakKeyDict mapping transports to lists of usernames?)
>
> Couldn't we just log them at the time the username is sent, and then
> later log that the same client disconnected?

Yeah, that would be simpler. All log messages from the same connection
are identified already (id(transport) is part of the log message) so
this should be fairly easy.

Cheers,
mwh