On Thu, Mar 19, 2009 at 10:36 AM, Johan Blåbäck <johan.bluecr...@gmail.com> wrote: > I've always had usernames when it comes to sshd's log entries in > auth.log, like the following: > > <time> <hostname> sshd[5926]: error: PAM: Authentication failure for > <username> from <ip-adress>
Well, I don't use PAM, just key-based authentication only, so I always see only the IP getting rejected since it doesn't even give them a place to try a user/password :) It's just weird that it is refusing a connection from u...@domain rather than simply the IP. I guess they could be trying to ssh u...@myhost.net or something. The one with [U2FsdGVkX19g32YZVKMsQkl+mouWITILOicY4Iq9OQo=] as the username is interesting. I wonder what that's all about.
