Server Management - Systems Insight Manager
cancel
Showing results for 
Search instead for 
Did you mean: 

SSHD Errors in Event Logs

SOLVED
Go to solution
Richard Colebeck
Occasional Advisor

SSHD Errors in Event Logs

On any Windows server that has HP's OpenSSH Server installed I'm getting a lot of events logged in the application event log. The following is a cut and paste from 5 event logs.
=====================
Did not receive identification string from 10.1.1.15.
Illegal user root from 10.1.1.15
input_userauth_request: illegal user root
Failed none for illegal user root from 10.1.1.15 port 4643 ssh2
Received disconnect from 10.1.1.15: 11: The user disconnected the application.
======================

Does anyone know what process/task may be causing "root" to login via ssh?
Is it possible I have something misconfigured?

Thanks,
RichardC
3 REPLIES
Richard Colebeck
Occasional Advisor

Re: SSHD Errors in Event Logs

Bit of an update:
It seems that the "Daily Device Identification" task is what causes these event log entries. I can run the task manually and the entries show up in the log.

Has anyone seen this before?

Richard...
qun
Occasional Visitor
Solution

Re: SSHD Errors in Event Logs

This is the normal behavior for hpsim. The identification tries to connect the ssh server port to test whether there is an ssh server, if there is one, which ssh protocol(v1 or v2) it supports. In order to do this, it has to supply a username even though the identification has not intention to actually log into the server. Once the identification process gets the needed information from the ssh server, it will abort the connection.
Richard Colebeck
Occasional Advisor

Re: SSHD Errors in Event Logs

Thanks for the reply.
This explains the behaviour I'm seeing as normal.

Take Care,

RichardC...