SSH Logs – What Does ‘Normal Shutdown, Thank You for Playing [preauth]’ Mean in SSH Logs?

logwatchssh

Recently, My SSH log summaries for my Ubuntu 12.04 servers in Logwatch have started showing entries for "11: Normal Shutdown, Thank you for playing [preauth]" along with the "11: Bye Bye [preauth]" and "11: disconnected by user" messages they had been showing previously.

I have not seen this message in my logs before the past few weeks, nor have I seen it on my older servers which are stuck on Ubuntu 10.04. I have googled this message and can't find any clear explanations there either.

The IPs attempting to login and receiving this message are random hack attempts, and judging from the preauth I assume (hope) they are not successful, but I would like to know exactly what this message means and how it differs from others to be sure.

EDIT for additional information: My servers have password authentication and root authentication both disabled

Best Answer

When the ssh client does a "normal" connection shutdown, it sends a packet with a message in it. When the ssh daemon gets such a packet when it's not expecting it -- in this case, before the user managed to authenticate -- it logs the message. (Older versions of OpenSSH did not do this.) So your surmise is exactly correct: it's a side effect of a brute-force ssh password-guessing attack. You should probably be running something like fail2ban or sshguard to block these in iptables; even if you think everything is correctly configured to disallow passwords, it's well to have a second layer of defense.

Try ssh -Y

Any reason you don't want to use the -Y flag instead of the -X flag?

Quite simply, the difference between -X and -Y is that -Y enables trusted X11 forwarding.

Allow Password Authentication to SSH Server from Internal Network Only

The Match directive in /etc/ssh/sshd_config allows you to selectively apply configuration directives. One of the available match criteria is the source address of the connection, and so this can be used to implement what you want. You can disable password authentication by default, and then enable it for connections from internal network IP ranges. (Note that you also want to disable ChallengeResponseAuthentication in order to prevent passwords being used.) This example allows password authentication from all RFC1918 private IP ranges. See the sshd_config manpage for more details.

PasswordAuthentication no
ChallengeResponseAuthentication no

Match Address 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
    PasswordAuthentication yes

Note that Match block should be added to the end of the file otherwise everything that follows it would be matched until the next Match block. The bad positioning of Match block may cause inability to connect.

Best Answer

Related Solutions

SSH – Warning: Untrusted X11 Forwarding Setup Failed

Try ssh -Y

Allow Password Authentication to SSH Server from Internal Network Only

Related Topic