OpenSSH does not log failed authentication attempts when PublicKey method is used

[jasonwc]

Version: Ubuntu 8.10 (Intrepid)
Package: openssh-server:
  Installed: 1:5.1p1-3ubuntu1
  Candidate: 1:5.1p1-3ubuntu1
  Version table:
 *** 1:5.1p1-3ubuntu1 0
        500 http://us.archive.ubuntu.com intrepid/main Packages
        100 /var/lib/dpkg/status

What I expected: I expected failed public key authentication attempts to be logged by default in /var/log/auth.log.

What happened: OpenSSH does not log failed public key authentication attempts by default ("LogLevel INFO"), however failed attempts using password authentication are logged, as are attempts to login with an invalid username.

Fix: Change "LogLevel INFO" to "LogLevel VERBOSE" in /etc/ssh/sshd.conf. This shouldn't be necessary as failed authentication attempts ought to be logged by default, especially considering the possibility that users may be using vulnerable keys generated before the recent openssl patch.

See https://bugzilla.mindrot.org/show_bug.cgi?id=1468 (suggests the bug has been fixed in OpenSSH 5.1)

[Kees Cook (kees)]

Colin, what is your opinion on this? Upstream doesn't seem to want to change the setting, but it does seem strange. Auth failures (regardless of origin) should be logged by default.

[haeckse (haeckse)]

In the version that comes with karmic (5.1p1) and at least one other I compiled from source (5.3p1) it doesn't get logged at all if someone tries to login with a valid username but a wrong keypair!
Even setting the LogLevel to debug doesn't change that.

[Don Reid (thebunfighter)]

Hi, this seems to be the same bug as:

https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956

Regards, Don.

[Jamie Strandboge (jdstrand)]

Marking as dupe of bug #501956 since it has more info.