0
I am getting the error below from my /var/adm/messages
(or syslog)
Aug 28 19:11:21 myhost sshd[25570]: [ID 800047 auth.info] Keyboard-interactive (PAM) userauth failed[9] while authenticating: Authentication failed
Aug 28 19:12:50 myhost sshd[25570]: [ID 800047 auth.crit] fatal: Read from socket failed: Connection reset by peer
- Who is actually trying to ssh to the server? Why isn't there any username or terminal name?
- Is
25570
the process ID? Are we able to get more information about the process? - What should be done next?
Which OS are you using? Are the two error messages above in the client or int he server's logs? – MariusMatutiae – 2015-08-28T16:21:11.313
i am using solaris, these 2 message are from the server log /var/adm/messages – Noob – 2015-08-28T18:27:52.463
is the PID of the SSHD process, so, assuming you know you have SSH running on the server, that won't tell you too much. usually the log files should tell you the user account being used with a keyboard-interactive login attempt. are there any additional messages in /var/syslog (or whereever it is in solaris)? – Frank Thomas – 2015-08-28T18:38:39.470
@FrankThomas no, there isn't any additional message. normally, it will show which user attempt to login, but for this log entry, there isn't. is the server trying to login to itself ? hence no username ? – Noob – 2015-08-28T20:09:57.920
then it would still use an account (probably root, or a daemon user). – Frank Thomas – 2015-08-28T20:31:01.227
@FrankThomas in that case, what could be trying to login via ssh on my case above ? any idea what does the error means esp on the 2nd line – Noob – 2015-08-28T20:40:01.003
The error on the second line means that after the user at the other end tried once and failed to log in, they then disconnected instead of trying again and again. Since normally after an authentication failure the SSH daemon will ask the user to try again, when the user instead dropped the connection, this resulted in a failure to read from a no-longer-open socket. – This isn't my real name – 2015-10-30T17:39:33.367