• 3 replies
  • Latest Post - ‏2011-05-31T18:59:20Z by aaron757
1 Post

Pinned topic ssh logging problem

‏2010-11-05T22:44:35Z |

I have successfully logged in to a server. when i see the /var/adm/messages i see the below messages. How can we fix this logging problem.

auth|security:info sshd451262: Accepted password for xxxxxx from x.x.x.x port 49445 ssh2
Nov 5 17:41:15 hostname auth|security:info sshd451262: Writing login record failed for xxxxxx

Updated on 2011-05-31T18:59:20Z at 2011-05-31T18:59:20Z by aaron757
  • SystemAdmin
    134 Posts

    Re: ssh logging problem

    since openssh is open source you can easily find the code that causes this message. or have someone find it for you.
  • Repcsi
    4 Posts

    Re: ssh logging problem

    If this error still persists, you should provide the "lslpp -l | grep open" output, or the rpm relevant version if you installed openssh that way.

    You may also raise loglevel to debug in the sshd config file to help finding the error.
  • aaron757
    1 Post

    Re: ssh logging problem

    I'm seeing the same issues however this may not be a problem that IBM can fix unless they want to assist the openssh project.

    I have compiled OpenSSH 5.8p1 for AIX 5.3 and upon successful login I get the following (with sshd in debug3):

    <snipped stuff>
    auth|security:debug sshd2318544: debug3: mm_request_receive entering
    auth|security:debug sshd2318544: debug3: monitor_read: checking request 25
    auth|security:debug sshd2318544: debug3: mm_answer_pty entering
    auth|security:debug sshd2318544: debug2: session_new: allocate (allocated 0 max 10)
    auth|security:debug sshd2318544: debug3: session_unused: session id 0 unused
    auth|security:debug sshd2318544: debug1: session_new: session 0
    auth|security:debug sshd2318544: debug3: AIX/setauthdb set registry 'NIS'
    auth|security:debug sshd2318544: debug3: aix_restoreauthdb: restoring old registry ''
    auth|security:info sshd2318544: Writing login record failed for USER
    auth|security:debug sshd2318544: debug1: audit session open euid 0 user USER tty name /dev/pts/0
    auth|security:debug sshd2318544: debug3: mm_request_send entering: type 26
    auth|security:debug sshd2318544: debug3: mm_answer_pty: tty /dev/pts/0 ptyfd 6
    auth|security:debug sshd2318544: debug3: mm_request_receive entering

    For some reason OpenSSH seems to have problems in the platform independent loginrec.c where the error seems to be generated from. Since I'm not a developer I'm not sure where it's trying to write that it fails, however I can see that /var/adm/wtmp gets updated each time I log in and /etc/utmp sometimes gets updated (???).