audit records

From: Andrew Thompson <thompsa_at_freebsd.org>
Date: Fri, 17 Nov 2006 12:24:50 +1300
Hi,


I thought i'd try out the new audit system and simulate an invalid login.
I was suprised to see that ssh connections to localhost show up as
255.255.255.255, is this an error?

% ssh df_at_localhost
header,94,10,OpenSSH login,0,Fri Nov 17 12:16:44 2006, + 100 msec
subject,-1,-1,-1,-1,-1,1378,1378,60666,255.255.255.255
text,invalid user name "df"
return,failure : No such process,4294967295
trailer,94

% ssh df_at_192.168.0.182
header,95,10,OpenSSH login,0,Fri Nov 17 12:17:26 2006, + 892 msec
subject,-1,-1,-1,-1,-1,1385,1385,58511,192.168.0.182
text,invalid user name "df"
return,failure : No such process,4294967295
trailer,95



Andrew
Received on Thu Nov 16 2006 - 22:24:53 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:39:02 UTC