;Enc: aes256-ctr;MAC: hmac-sha1;Comp: none (messages)

[aamir4u]

Hi all,

My syslog file contained following messages.:---

Jan 12 10:50:32 prodpyrl sshd[17966]: SSH: Server;Ltype: Version;Remote: 192.168.2.38-49568;Protocol: 2.0;Client: WinSCP_release_4.1.9
Jan 12 10:50:49 prodpyrl sshd[17966]: Accepted keyboard-interactive/pam for pyrluser from 192.168.2.38 port 49568 ssh2
Jan 12 10:50:49 prodpyrl sshd[17994]: subsystem request for sftp
Jan 12 11:50:33 prodpyrl sshd[17994]: SSH: Server;Ltype: Kex;Remote: 192.168.2.38-49568;Enc: aes256-ctr;MAC: hmac-sha1;Comp: none
Jan 12 12:50:35 prodpyrl sshd[17994]: SSH: Server;Ltype: Kex;Remote: 192.168.2.38-49568;Enc: aes256-ctr;MAC: hmac-sha1;Comp: none
Jan 12 13:50:36 prodpyrl sshd[17994]: SSH: Server;Ltype: Kex;Remote: 192.168.2.38-49568;Enc: aes256-ctr;MAC: hmac-sha1;Comp: none
Jan 13 11:42:16 prodpyrl sshd[28062]: SSH: Server;Ltype: Version;Remote: 192.168.4.6-50442;Protocol: 2.0;Client: OpenSSH_5.0p1+sftpfilecontrol-v1.2-hpn13v1
Jan 13 11:42:23 prodpyrl sshd[28062]: Accepted keyboard-interactive/pam for root from 192.168.4.6 port 50442 ssh2
Jan 13 11:43:29 prodpyrl sshd[28062]: SSH: Server;LType: Throughput;Remote: 192.168.4.6-50442;IN: 56816;OUT: 3648;Duration: 65.8;tPut_in: 863.7;tPut_out: 55.5

What it is mean.

why these messages had on syslog file.

Thnks

[rariasn]

Hi:

SSH is configured to send authorization messages to syslog file.

Rgs,

[BowlesCR]

That's all completely normal. SSHd is reporting the steps it is taking to authenticate an incoming user - namely 'pryluser'.