Server Management - Systems Insight Manager
Showing results for 
Search instead for 
Did you mean: 

SSHD Errors in Event Logs

Go to solution
Richard Colebeck
Occasional Advisor

SSHD Errors in Event Logs

On any Windows server that has HP's OpenSSH Server installed I'm getting a lot of events logged in the application event log. The following is a cut and paste from 5 event logs.
Did not receive identification string from
Illegal user root from
input_userauth_request: illegal user root
Failed none for illegal user root from port 4643 ssh2
Received disconnect from 11: The user disconnected the application.

Does anyone know what process/task may be causing "root" to login via ssh?
Is it possible I have something misconfigured?

Richard Colebeck
Occasional Advisor

Re: SSHD Errors in Event Logs

Bit of an update:
It seems that the "Daily Device Identification" task is what causes these event log entries. I can run the task manually and the entries show up in the log.

Has anyone seen this before?

Occasional Visitor

Re: SSHD Errors in Event Logs

This is the normal behavior for hpsim. The identification tries to connect the ssh server port to test whether there is an ssh server, if there is one, which ssh protocol(v1 or v2) it supports. In order to do this, it has to supply a username even though the identification has not intention to actually log into the server. Once the identification process gets the needed information from the ssh server, it will abort the connection.
Richard Colebeck
Occasional Advisor

Re: SSHD Errors in Event Logs

Thanks for the reply.
This explains the behaviour I'm seeing as normal.

Take Care,