Bug 65

Summary:

TCP Wrappers support does not log successful connections

Product:

Portable OpenSSH

Reporter:

Joseph <jap3003+opensshbugs>

Component:

sshd

Assignee:

OpenSSH Bugzilla mailing list <openssh-bugs>

Status:

CLOSED WONTFIX

Severity:

normal

Priority:

Version:

-current

Hardware:

All

OS:

All

Attachments:

Description	Flags
Patch to fix this bug (gdiff -u)	none

Description Joseph 2002-01-07 09:49:08 AEDT

sshd does not log connections that succeed the hosts_access() function.  Failed
connections are logged in tcp wrappers [via refuse()], but special care must be
taken to log connections that succeed.  It's not a show-stopper, since other,
more detailed logging mechanisms exist, but it'd be a nice thing to have, since
it shows that the allowed connection passed the wrappers.  That, and tcpd and
the commercial [at least verision 1.2.whatever] do it.

Comment 1 Joseph 2002-01-07 09:54:19 AEDT

Created attachment 8 [details]
Patch to fix this bug (gdiff -u)

Comment 2 Markus Friedl 2002-01-17 02:22:43 AEDT

shouln't the tcpwrapper do this?
we should not call syslog at all

Comment 3 Joseph 2002-01-17 03:14:15 AEDT

"should?"  Maybe.  "Does?"  No.  This is the way tcpd does it, too.  The call to
hosts_access() only determines whether or not a host should pass.  refuse()
[iirc, don't have the source handy] terminates sshd after calling syslog.  There
doesn't appear to be a corresponding accept() function.  However, the fact that
we have to call syslog ourselves is mitigated by the fact that there is a
function available to crack the request structure, so we don't really have to go
dinking with the tcp wrapper internals.  It's the %s being sent into the syslog.
 Although it's not mentioned on the manpage, it's in the header we include.

Comment 4 Michael Stone 2002-01-18 00:27:43 AEDT

I'm confused. If I set LogLevel VERBOSE in sshd_config, I get something like
this in the syslog:

Jan 17 08:12:39 myhost sshd[432]: Connection from somehost port someport

What else is desired?

Comment 5 Damien Miller 2003-01-07 15:33:26 AEDT

You can do this by setting LogLevel verbose

Comment 6 Damien Miller 2004-04-14 12:24:17 AEST

Mass change of RESOLVED bugs to CLOSED