topic SSHD Errors in Event Logs in Server Management - Systems Insight Manager

SSHD Errors in Event Logs

Richard Colebeck — Mon, 12 Dec 2005 16:59:13 GMT

On any Windows server that has HP's OpenSSH Server installed I'm getting a lot of events logged in the application event log. The following is a cut and paste from 5 event logs.
=====================
Did not receive identification string from 10.1.1.15.
Illegal user root from 10.1.1.15
input_userauth_request: illegal user root
Failed none for illegal user root from 10.1.1.15 port 4643 ssh2
Received disconnect from 10.1.1.15: 11: The user disconnected the application.
======================

Does anyone know what process/task may be causing "root" to login via ssh?
Is it possible I have something misconfigured?

Thanks,
RichardC

Re: SSHD Errors in Event Logs

Richard Colebeck — Tue, 13 Dec 2005 08:49:28 GMT

Bit of an update:
It seems that the "Daily Device Identification" task is what causes these event log entries. I can run the task manually and the entries show up in the log.

Has anyone seen this before?

Richard...

Re: SSHD Errors in Event Logs

qun — Wed, 14 Dec 2005 02:21:56 GMT

This is the normal behavior for hpsim. The identification tries to connect the ssh server port to test whether there is an ssh server, if there is one, which ssh protocol(v1 or v2) it supports. In order to do this, it has to supply a username even though the identification has not intention to actually log into the server. Once the identification process gets the needed information from the ssh server, it will abort the connection.

Re: SSHD Errors in Event Logs

Richard Colebeck — Wed, 14 Dec 2005 08:50:26 GMT

Thanks for the reply.
This explains the behaviour I'm seeing as normal.

Take Care,

RichardC...