I upgraded to ver 3.9p1 and noticed it doesnt log refused connections (auth.warning) to /var/log/authlog anymore. I tried on two systems. The second was logging refused connection (ip addresses trying to connect that arent in /etc/hosts.allow) okay on 3.7.1p1. I left all the configs the same and upgraded only the openssh package to 3.9p1 and it stopped reporting the refused connections. This means I have little indication of hacker attempts. OS - Solaris 8 ( recommended patch cluster from January 2005) Hardware - sparc 5 and Ultra 1 openssl-0.9.7e-sol8-sparc-local zlib-1.2.2-sol8-sparc-local openssh-3.9p1-sol8-sparc-local libgcc-3.3-sol8-sparc-local tcp_wrappers-7.6-sol8-sparc-local I searched for a day for any references anywhere for this issue. I hope its a new one so Im not wasting anyones time. Feel free to email me for further info.
This may be Bug #973. Can you try one of the snapshot releases to see if this is fixed there?
I installed snapshot 20050303 and the auth.warning logging is working nicely. Thanks.
Change all RESOLVED bug to CLOSED with the exception of the ones fixed post-4.4.