From owner-freebsd-questions@freebsd.org Sun Dec 16 17:49:22 2018 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 6F6601335021 for ; Sun, 16 Dec 2018 17:49:22 +0000 (UTC) (envelope-from idefix@fechner.net) Received: from anny.lostinspace.de (anny.lostinspace.de [IPv6:2001:608:a02::33]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id BA7CB901C1 for ; Sun, 16 Dec 2018 17:49:21 +0000 (UTC) (envelope-from idefix@fechner.net) Received: from server.idefix.lan (unknown [IPv6:2a01:5c0:e082:de51:21b:21ff:fe7b:3468]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: idefix@fechner.net) by anny.lostinspace.de (Postfix) with ESMTPSA id 1BECA6F1C5 for ; Sun, 16 Dec 2018 18:49:19 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=fechner.net; s=default; t=1544982559; bh=VB0s6iMzEyE8db1aBQYG/n3dDIguOoqQx/oTxOiLDBE=; h=To:From:Subject:Date; b=VyGsEbbdB/P0Jw+zuZ1U1Q9ePRfYGOD9ePykbUc7W2h604mfv8MX0FjMarrUTqrTt TxokMhSGicjx9yf8b+izzRA5WrW70VYY+NVd75AkLPlZNn4Z0cHkj59n/ZmnWZrtU3 ufZ6ig1H7m0WqucKvcKzqu5+0LuAaVMmluXgSK1g= Received: from [192.168.0.87] (184-103-000-128.ip-addr.inexio.net [128.0.103.184]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by server.idefix.lan (Postfix) with ESMTPSA id 91AA93D539A for ; Sun, 16 Dec 2018 18:49:18 +0100 (CET) To: freebsd-questions@freebsd.org From: Matthias Fechner Subject: FreeBSD 12 shows successfull logins with an error in auth.log Openpgp: preference=signencrypt Autocrypt: addr=idefix@fechner.net; prefer-encrypt=mutual; keydata= mQINBFqca1YBEADM9mF2+ifk8HILTlf5wtAzV6SYVR4RvNOo/8Kucw4sCZT76zS1fjZe4Zy1 3C0IZ07Wi+3PnoGIgOCsXp3PrTc2nuHQWkwVBYXy8UaR9DHBWA/mIvRGG1ZscKQYA6oUdCvd K8Mu26zO60yTt+ONzFtK6G1myH4EHXZ8dpmdCFf+W3rzTU+aCQ5S3OfwCLGgYgOaVREGkdOc 5SVCpFb4n+2B8+CqeWsRHhnT+4h7/YhgDMGp4GiI3yrB2nBVSUUvcosD2nRtJQgGQHcAFtMq 3hJaKPOR/mHc6KVrp0xmGNmdtazvXloHmGIl9O1UpmMmrYu9Kugl0JkGi2fAcno02XgVlkyX 7xDLTteP5cNqRxor4yVDaRWUQnOfK9XgcrKGrAzb65BkCSkjT+Aw3S/A8Qd6NvjL9qy1d+Ct dzatOVF/Y7jaW28CMr3jvwPS13OxV7PnJzIZzdik20eVxfOXuYfxZD+PwBaGgFF0qj6zKACC aKLalE0ZpY0zNn/iPyQX/Cf9KoDyFpOHSsEswiJ5rCWwppVcsFyogHOemVmeaXlvyDPEipnV ZUkpGP/CCqPu3eD0uDzP7UJ0pt/l/JfW0Xw/4p9mjB024xiRlxLa6vSRfGl//EdtAIbKKa8x 5wsKTQEbYJDmXE3tH/A54DCqRXhcopTlu2iJlTdnIMltn9afVwARAQABtCVNYXR0aGlhcyBG ZWNobmVyIDxpZGVmaXhAZmVjaG5lci5uZXQ+iQJXBBMBCgBBAhsDBQkJZgGABQsJCAcDBRUK CQgLBRYDAgEAAh4BAheAFiEEaWB64mCp804YOtqutot13J/XR+EFAlqcc9gCGQEACgkQtot1 3J/XR+GQyhAAwDxUSg7X2aS1d6rrYUZdDk8rT5TCjayDAyOATdAUhJRZk8qXRNF27Mu6xiOT mIvEMKLagNsitffZs1g/mulRQiDVLloGav7xozSfYlaOYWpPb55wpsugQPLZz0OkU9tzw7j7 7sPPvnAxeqSofUJzQdZzp43aVwXVqsJ3rY0jGzYA5RLS6CBI1RRR8/hHLMxspDPl79IW3GhI HAXaVX1HVJA2oJEo9Y95DnJwX8NV+hvLlUVA2KDdNKFiVJKeV3ccqw+/5zW3Y8J6Rd8blW9n p68Z7lyxt6mvsDEdSxOyGSkPagzIDfHqmDfkaeum7gHMwweH2e2pZuhzMZkrKNoSkKiJ5uim 638ZhnzzmEWh2qtYPgHlZG1jO6n2DSzCqJkQYjYUtLj7ylIgZakG8M3idQRugHImMBq+HSMu WR8FI52gh1+4LbIArHB4YWTTr933ElwhS1jtomK9SeWezPfjunpxqXQl4QR0qXAuglsOMJ6y Togb6lc0qyEdOa5VCXQTLSD9yZpolSQOjOe1XEyM4g5v7FrPBGVni9AxlARvUDVbYQDv1+4A gchtgpLmAF8mDPq/tGeXuAO3m+ExQDXpJ4CneI9YHc+joU2cXQi5MP1NzgMOV43XEZCiTW0O BWM1+857gmDqGbybE7F3UFpvBs9/NRWnuxoKaYxYbqCOc3m5Ag0EWpxrVgEQAN3uCLHZF+1V gcrzYjwL1wAJwjYb7UnHKvNYdaBKgW0n0NTfaTCLHxHYPO8NlV1+lNctSeXLeiWpmE1lCDHq /++53EJ34OsRd/n246PdtfIfltML73tsmq6S9zTye2zv7LsmE7jgUBaasbv0qSLSybOUvkRx j3xBuK9Ymg/ZXaENOhxwIQ6oQoNLg3ers9t5Xl4NVK6gzzZ2OdTGnuUVhQmi4rbP04R0GJFh AtGLAYUCxlXVZhdPAs4qZaoAEP5nW/u2MyzSaIouwcEIdttAiPZdrJr+a4OGKz88Sn6zqKSa uyUADgX+G8tKUONgZbfz4SSRvlinOgyU2RyyfNS977r/YfaHH+oAxg31yUWPtD/ryfVw69bG vK8RQrZ9+c1vyWBABoQOh5+JHW/AE9Xj5dQatEfWmGO3+/FRo2TIhqZQXXl8PW+jtEjkhgOH OUX5ERzSm6nCcPIw+LUkEINcLc9bw4fv1eOWIdBuCckGM4rWXkLYbqhdSzdWeCsC0tiQk8x7 O1zXRJOKF4rITJd/qX322EH29BR+T9V1Hw7LDSRe+3YxtoXhROZRXjF8QniEHeKVNRUComr6 rWGmuHjsNTQ7twtwnG8xSOfCkYAp9GrbzBkIYX+VFvFQLqVM+It3RAlge/bwpZPvkr3bFsJk 4JS+EAugBIrP0xd9BMOh6Ej5ABEBAAGJAjwEGAEKACYWIQRpYHriYKnzThg62q62i3Xcn9dH 4QUCWpxrVgIbDAUJCWYBgAAKCRC2i3Xcn9dH4ZZsEACoQI109htphVe2AQhJ7wuPo8pIrSFA 0Mb0pfibX/sYw8ZZz/x3ctTI3Ajq2baSaoebIuUyd6oPI7cAzgL4s2zHiZ3ChH2dDxJlOPfk OaiK124DJMPqWiWuxe39tgq23tsPhwcvF+DC+SkJoLWKCYNC06fS3bLktZ0s4lVE5tqfL5ww MvxgxB+6+sWHwZWSv1IwB/geov6zkEhVdkXqrGPE52LyLfU0ACMmihcl0/npsCMZSls0urge CsPMuHPQnmcM2ERbere8i9OdKQDzGBrTbWl9DxNRf4o+cAYirEJM3Kc+ZD2SE34bTSvg3kdQ QZQbj+o+BRcsR0LaGbORkNaMZlp5OuXteL6nG7sbAPn0bjUUlup8CJEXDXENG6LJG1/oVWFq m3OtPyr5UoMQAuhuGx0/Om6AXKr/mk+veuoKWMXkqll045/bYE7bX2A0gkyGE5DdjaiHPmS9 NsWuKDeExLlXZOL1GX+PKjWLADwlv07XHB8Hf6U0/lpf3/mggRtqHyKbHt0iRqYaMC95gVdM rbugxh61U/zxIaweU7VolD5cRrltxqPp5szOwDzw42JYwbpYsXFJXNkuCGCmK1LHcShfEggt fV3g/JKzvNRQn6p1f0frppl/eZ5UvWVKrNERJzcZgkOecxwiK/L/JoGpGfWOqWGsTxe/AnQc Xxj8Dw== Message-ID: <857dfd87-0cd6-ad20-6a67-f13cf00ee62a@fechner.net> Date: Sun, 16 Dec 2018 18:49:17 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.3.3 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Content-Language: de-DE X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 16 Dec 2018 17:49:22 -0000 Dear all, I started now to upgrade the first servers from 11.2 to 12.0. Now if I login with ssh to the server I see the following messages in auth.log which causes fail2ban to block the IP after some successfull logins: Dec 16 18:45:16 _server_ sshd[74059]: Failed unknown for xxx from 2a01:5c0:e082:xxxx:xxxx:xxxx:xxxx:xxxx port 56676 ssh2 Dec 16 18:45:16 _server_ sshd[74059]: user idefix login class  [preauth] Dec 16 18:45:16 _server_ sshd[74059]: Accepted publickey for xxx from 2a01:5c0:e082:xxxx:xxxx:xxxx:xxxx:xxxx port 56676 ssh2: ED25519 SHA256:xxx Is there a reason why I get the `failed unkown for ...` log line? Has anyone an idea, who to fix this? Thanks. Gruß Matthias -- "Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the universe trying to produce bigger and better idiots. So far, the universe is winning." -- Rich Cook