I think it is pointless to print this message in input_userauth_request() because invalid users are always be reported by auth_log() in userauth_finish(). It should be demoted to a debugging message.
What if they disconnect before that?
Hmm...well...if clients can prevent sshd from logging a failed authentication attempt then we have a much wider and much more serious problem and "input_userauth_request: illegal user ..." does not solve it--what if the username was valid? what if the client connected using protocol 1?
Such failures get logged anyway: Apr 17 12:45:33 xenon sshd(pam_unix)[21188]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=localhost.localdomain user=root Apr 17 12:45:35 xenon sshd[21188]: Failed password for root from 127.0.0.1 port 34002
With all due respect, you should re-read the original report. :) If "such failures get logged anyway" (*) then that annoying and redundant log("input_userauth_request: illegal user %s", user) can really go away (or be reduced to a debugging message). (*) Well, whether pam_unix logs them depends on whether the particular implementation of pam_unix does it and whether pam_unix is used at all but this is a completely different question.
but the username might not get logged.
hm, permitted users won't get logged in the same case. not sure whether they should. we could try logging the username on disconnect. does this make sense?
Yes, something like "User joedoe disconnected in the middle of keyboard-interactive authentication." or "Illegal user blahblah disconnnected..." if the client disconnects during the authentication.
Resolved in: commit f1a193464a7b77646f0d0cedc929068e4a413ab4 Author: djm@openbsd.org <djm@openbsd.org> Date: Fri Feb 3 23:05:57 2017 +0000 upstream commit use ssh_packet_set_log_preamble() to include connection username in packet log messages, e.g. Connection closed by invalid user foo 10.1.1.1 port 44056 [preauth] ok markus@ bz#113 Upstream-ID: 3591b88bdb5416d6066fb3d49d8fff2375bf1a15 commit 07edd7e9537ab32aa52abb5fb2a915c350fcf441 Author: djm@openbsd.org <djm@openbsd.org> Date: Fri Feb 3 23:03:33 2017 +0000 upstream commit add ssh_packet_set_log_preamble() to allow inclusion of a preamble string in disconnect messages; ok markus@ Upstream-ID: 34cb41182cd76d414c214ccb01c01707849afead
btw I removed the log message that was the source of the original complain in the same commit
closing resolved bugs as of 8.6p1 release