CentOS 7 “Invalid user __ from xx.xx.xx.xx port xxx” - Not showing the attempted username entered
When taking a look into my /var/log/secure logging file, I'm able to see attempts to log into my CentOS system via SSH, however, the username is blank. I've recreated this myself by entering false usernames, but the log still shows it being blank.
Feb 11 15:40:02 centos sshd[15369]: Invalid user from xxx.181.90.221 port 51474
Feb 11 15:40:48 centos sshd[15394]: Invalid user from xxx.181.90.221 port 51514
Feb 11 15:40:57 centos sshd[15396]: Invalid user from xxx.181.90.221 port 51526
Feb 11 15:49:15 centos sshd[15462]: Invalid user from xxx.181.90.221 port 51933
Feb 11 15:49:24 centos sshd[15464]: Invalid user from xxx.181.90.221 port 51941
Feb 11 15:49:31 centos sshd[15466]: Invalid user from xxx.181.90.221 port 51948
Feb 11 15:58:55 centos sshd[15622]: Invalid user from xxx.181.90.221 port 52415
Feb 11 15:59:02 centos sshd[15624]: Invalid user from xxx.181.90.221 port 52422
Feb 11 15:59:08 centos sshd[15626]: Invalid user from xxx.181.90.221 port 52427
Feb 11 16:05:13 centos sshd[15684]: Invalid user from xxx.181.90.221 port 52723
Feb 11 16:05:37 centos sshd[15688]: Invalid user from xxx.181.90.221 port 52741
Feb 11 16:15:10 centos sshd[15776]: Invalid user from xxx.181.90.221 port 53203
Feb 11 16:19:23 centos sshd[3862]: Invalid user from xxx.181.90.221 port 53410
Any idea on how I could get this to provided the attempted username? This seemed to start happening after I set up Fail2Ban.
Thanks!
EDIT: It looks as though it will only log the usernames that are attempted from an internal IP address. Any external IP address will not log the username. Here is an external address trying to connect:
Feb 11 16:19:23 centos sshd[3862]: Invalid user from xxx.181.90.221 port 53410
and here it is from an internal IP:
Feb 11 19:12:33 centos sshd[4193]: Invalid user badusername from 192.168.1.10 port 1718
linux centos ssh login
asked Feb 11 at 23:25
veanomeveanome
83
|
show 3 more comments
When taking a look into my /var/log/secure logging file, I'm able to see attempts to log into my CentOS system via SSH, however, the username is blank. I've recreated this myself by entering false usernames, but the log still shows it being blank.
Feb 11 15:40:02 centos sshd[15369]: Invalid user from xxx.181.90.221 port 51474
Feb 11 15:40:48 centos sshd[15394]: Invalid user from xxx.181.90.221 port 51514
Feb 11 15:40:57 centos sshd[15396]: Invalid user from xxx.181.90.221 port 51526
Feb 11 15:49:15 centos sshd[15462]: Invalid user from xxx.181.90.221 port 51933
Feb 11 15:49:24 centos sshd[15464]: Invalid user from xxx.181.90.221 port 51941
Feb 11 15:49:31 centos sshd[15466]: Invalid user from xxx.181.90.221 port 51948
Feb 11 15:58:55 centos sshd[15622]: Invalid user from xxx.181.90.221 port 52415
Feb 11 15:59:02 centos sshd[15624]: Invalid user from xxx.181.90.221 port 52422
Feb 11 15:59:08 centos sshd[15626]: Invalid user from xxx.181.90.221 port 52427
Feb 11 16:05:13 centos sshd[15684]: Invalid user from xxx.181.90.221 port 52723
Feb 11 16:05:37 centos sshd[15688]: Invalid user from xxx.181.90.221 port 52741
Feb 11 16:15:10 centos sshd[15776]: Invalid user from xxx.181.90.221 port 53203
Feb 11 16:19:23 centos sshd[3862]: Invalid user from xxx.181.90.221 port 53410
Any idea on how I could get this to provided the attempted username? This seemed to start happening after I set up Fail2Ban.
Thanks!
EDIT: It looks as though it will only log the usernames that are attempted from an internal IP address. Any external IP address will not log the username. Here is an external address trying to connect:
Feb 11 16:19:23 centos sshd[3862]: Invalid user from xxx.181.90.221 port 53410
and here it is from an internal IP:
Feb 11 19:12:33 centos sshd[4193]: Invalid user badusername from 192.168.1.10 port 1718
linux centos ssh login
asked Feb 11 at 23:25
veanomeveanome
83
fail2bandoesn't alter any of the logging processes. It simply reads the logs that get generated. If the format really did change then something else is responsible. (Do you have any evidence to confirm that the log file used to include the username?)
– roaima
Feb 12 at 0:51
Yes, earlier before I installed fail2ban and set the ssh logpath as /var/log/secure, it logged user names.Feb 11 12:39:54 centos sshd[15331]: Invalid user admin from xx.xx.xx.xx port 51285
– veanome
Feb 12 at 1:04
It also looks as though if I connect to my centos box from the internal IP address it will log the username, but if its an external IP address it will not log the username.
– veanome
Feb 12 at 1:11
Sure! I went ahead and made the edits. I'm going to do another restart of the CentOS machine and see if that may fix anything.
– veanome
Feb 12 at 14:58
1
The username used could actually have been empty or a space or tab, possibly in an attempt to confuse or bypass security (which didn't work on your system obviously).
– Kusalananda
Feb 12 at 15:01
|
show 3 more comments
When taking a look into my /var/log/secure logging file, I'm able to see attempts to log into my CentOS system via SSH, however, the username is blank. I've recreated this myself by entering false usernames, but the log still shows it being blank.
Feb 11 15:40:02 centos sshd[15369]: Invalid user from xxx.181.90.221 port 51474
Feb 11 15:40:48 centos sshd[15394]: Invalid user from xxx.181.90.221 port 51514
Feb 11 15:40:57 centos sshd[15396]: Invalid user from xxx.181.90.221 port 51526
Feb 11 15:49:15 centos sshd[15462]: Invalid user from xxx.181.90.221 port 51933
Feb 11 15:49:24 centos sshd[15464]: Invalid user from xxx.181.90.221 port 51941
Feb 11 15:49:31 centos sshd[15466]: Invalid user from xxx.181.90.221 port 51948
Feb 11 15:58:55 centos sshd[15622]: Invalid user from xxx.181.90.221 port 52415
Feb 11 15:59:02 centos sshd[15624]: Invalid user from xxx.181.90.221 port 52422
Feb 11 15:59:08 centos sshd[15626]: Invalid user from xxx.181.90.221 port 52427
Feb 11 16:05:13 centos sshd[15684]: Invalid user from xxx.181.90.221 port 52723
Feb 11 16:05:37 centos sshd[15688]: Invalid user from xxx.181.90.221 port 52741
Feb 11 16:15:10 centos sshd[15776]: Invalid user from xxx.181.90.221 port 53203
Feb 11 16:19:23 centos sshd[3862]: Invalid user from xxx.181.90.221 port 53410
Any idea on how I could get this to provided the attempted username? This seemed to start happening after I set up Fail2Ban.
Thanks!
EDIT: It looks as though it will only log the usernames that are attempted from an internal IP address. Any external IP address will not log the username. Here is an external address trying to connect:
Feb 11 16:19:23 centos sshd[3862]: Invalid user from xxx.181.90.221 port 53410
and here it is from an internal IP:
Feb 11 19:12:33 centos sshd[4193]: Invalid user badusername from 192.168.1.10 port 1718
linux centos ssh login
asked Feb 11 at 23:25
veanomeveanome
83
When taking a look into my /var/log/secure logging file, I'm able to see attempts to log into my CentOS system via SSH, however, the username is blank. I've recreated this myself by entering false usernames, but the log still shows it being blank.
Feb 11 15:40:02 centos sshd[15369]: Invalid user from xxx.181.90.221 port 51474
Feb 11 15:40:48 centos sshd[15394]: Invalid user from xxx.181.90.221 port 51514
Feb 11 15:40:57 centos sshd[15396]: Invalid user from xxx.181.90.221 port 51526
Feb 11 15:49:15 centos sshd[15462]: Invalid user from xxx.181.90.221 port 51933
Feb 11 15:49:24 centos sshd[15464]: Invalid user from xxx.181.90.221 port 51941
Feb 11 15:49:31 centos sshd[15466]: Invalid user from xxx.181.90.221 port 51948
Feb 11 15:58:55 centos sshd[15622]: Invalid user from xxx.181.90.221 port 52415
Feb 11 15:59:02 centos sshd[15624]: Invalid user from xxx.181.90.221 port 52422
Feb 11 15:59:08 centos sshd[15626]: Invalid user from xxx.181.90.221 port 52427
Feb 11 16:05:13 centos sshd[15684]: Invalid user from xxx.181.90.221 port 52723
Feb 11 16:05:37 centos sshd[15688]: Invalid user from xxx.181.90.221 port 52741
Feb 11 16:15:10 centos sshd[15776]: Invalid user from xxx.181.90.221 port 53203
Feb 11 16:19:23 centos sshd[3862]: Invalid user from xxx.181.90.221 port 53410
Any idea on how I could get this to provided the attempted username? This seemed to start happening after I set up Fail2Ban.
Thanks!
EDIT: It looks as though it will only log the usernames that are attempted from an internal IP address. Any external IP address will not log the username. Here is an external address trying to connect:
Feb 11 16:19:23 centos sshd[3862]: Invalid user from xxx.181.90.221 port 53410
and here it is from an internal IP:
Feb 11 19:12:33 centos sshd[4193]: Invalid user badusername from 192.168.1.10 port 1718
linux centos ssh login
linux centos ssh login
asked Feb 11 at 23:25
veanomeveanome
83
asked Feb 11 at 23:25
veanomeveanome
83
edited Feb 12 at 14:57
veanome
asked Feb 11 at 23:25
veanomeveanome
83
asked Feb 11 at 23:25
veanomeveanome
83
asked Feb 11 at 23:25
veanomeveanome
83
83
fail2bandoesn't alter any of the logging processes. It simply reads the logs that get generated. If the format really did change then something else is responsible. (Do you have any evidence to confirm that the log file used to include the username?)
– roaima
Feb 12 at 0:51
Yes, earlier before I installed fail2ban and set the ssh logpath as /var/log/secure, it logged user names.Feb 11 12:39:54 centos sshd[15331]: Invalid user admin from xx.xx.xx.xx port 51285
– veanome
Feb 12 at 1:04
It also looks as though if I connect to my centos box from the internal IP address it will log the username, but if its an external IP address it will not log the username.
– veanome
Feb 12 at 1:11
Sure! I went ahead and made the edits. I'm going to do another restart of the CentOS machine and see if that may fix anything.
– veanome
Feb 12 at 14:58
1
The username used could actually have been empty or a space or tab, possibly in an attempt to confuse or bypass security (which didn't work on your system obviously).
– Kusalananda
Feb 12 at 15:01
|
show 3 more comments
fail2bandoesn't alter any of the logging processes. It simply reads the logs that get generated. If the format really did change then something else is responsible. (Do you have any evidence to confirm that the log file used to include the username?)
– roaima
Feb 12 at 0:51
Yes, earlier before I installed fail2ban and set the ssh logpath as /var/log/secure, it logged user names.Feb 11 12:39:54 centos sshd[15331]: Invalid user admin from xx.xx.xx.xx port 51285
– veanome
Feb 12 at 1:04
It also looks as though if I connect to my centos box from the internal IP address it will log the username, but if its an external IP address it will not log the username.
– veanome
Feb 12 at 1:11
Sure! I went ahead and made the edits. I'm going to do another restart of the CentOS machine and see if that may fix anything.
– veanome
Feb 12 at 14:58
1
The username used could actually have been empty or a space or tab, possibly in an attempt to confuse or bypass security (which didn't work on your system obviously).
– Kusalananda
Feb 12 at 15:01
fail2ban doesn't alter any of the logging processes. It simply reads the logs that get generated. If the format really did change then something else is responsible. (Do you have any evidence to confirm that the log file used to include the username?)– roaima
Feb 12 at 0:51
fail2ban doesn't alter any of the logging processes. It simply reads the logs that get generated. If the format really did change then something else is responsible. (Do you have any evidence to confirm that the log file used to include the username?)– roaima
Feb 12 at 0:51
Yes, earlier before I installed fail2ban and set the ssh logpath as /var/log/secure, it logged user names.
Feb 11 12:39:54 centos sshd[15331]: Invalid user admin from xx.xx.xx.xx port 51285– veanome
Feb 12 at 1:04
Yes, earlier before I installed fail2ban and set the ssh logpath as /var/log/secure, it logged user names.
Feb 11 12:39:54 centos sshd[15331]: Invalid user admin from xx.xx.xx.xx port 51285– veanome
Feb 12 at 1:04
It also looks as though if I connect to my centos box from the internal IP address it will log the username, but if its an external IP address it will not log the username.
– veanome
Feb 12 at 1:11
It also looks as though if I connect to my centos box from the internal IP address it will log the username, but if its an external IP address it will not log the username.
– veanome
Feb 12 at 1:11
Sure! I went ahead and made the edits. I'm going to do another restart of the CentOS machine and see if that may fix anything.
– veanome
Feb 12 at 14:58
Sure! I went ahead and made the edits. I'm going to do another restart of the CentOS machine and see if that may fix anything.
– veanome
Feb 12 at 14:58
1
1
The username used could actually have been empty or a space or tab, possibly in an attempt to confuse or bypass security (which didn't work on your system obviously).
– Kusalananda
Feb 12 at 15:01
The username used could actually have been empty or a space or tab, possibly in an attempt to confuse or bypass security (which didn't work on your system obviously).
– Kusalananda
Feb 12 at 15:01
|
show 3 more comments
1 Answer
1
active
oldest
votes
fail2ban itself doesn't alter any of the logging processes. It simply reads the logs that get generated. However, I can reproduce the issue as described by specifying a null username:
ssh -l '' remote_host
The corresponding log entries in /var/log/auth.log on my Debian server are
Feb 12 16:35:43 remote_host sshd[6738]: Invalid user from 192.168.xx.yy port 26677
Feb 12 16:35:43 remote_host sshd[6738]: input_userauth_request: invalid user [preauth]
Looking closely you can see the double space between user and from in that first line, as seen in your own logs.
answered Feb 12 at 16:35
roaimaroaima
45.1k756122
1
I was able to get around to my testing. It looks like I'm able to log the username attempts now from both internal and external IP addresses. I'm guessing the username being entered in was just a space or empty as @Kusalananda suggested. Thanks for the help everyone!
– veanome
Feb 12 at 17:22
Based on my testing, if the username had been a space you'd have got three adjacent spaces in the log message.
– roaima
Feb 12 at 19:52
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f500066%2fcentos-7-invalid-user-from-xx-xx-xx-xx-port-xxx-not-showing-the-attempted%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
fail2ban itself doesn't alter any of the logging processes. It simply reads the logs that get generated. However, I can reproduce the issue as described by specifying a null username:
ssh -l '' remote_host
The corresponding log entries in /var/log/auth.log on my Debian server are
Feb 12 16:35:43 remote_host sshd[6738]: Invalid user from 192.168.xx.yy port 26677
Feb 12 16:35:43 remote_host sshd[6738]: input_userauth_request: invalid user [preauth]
Looking closely you can see the double space between user and from in that first line, as seen in your own logs.
answered Feb 12 at 16:35
roaimaroaima
45.1k756122
1
I was able to get around to my testing. It looks like I'm able to log the username attempts now from both internal and external IP addresses. I'm guessing the username being entered in was just a space or empty as @Kusalananda suggested. Thanks for the help everyone!
– veanome
Feb 12 at 17:22
Based on my testing, if the username had been a space you'd have got three adjacent spaces in the log message.
– roaima
Feb 12 at 19:52
add a comment |
fail2ban itself doesn't alter any of the logging processes. It simply reads the logs that get generated. However, I can reproduce the issue as described by specifying a null username:
ssh -l '' remote_host
The corresponding log entries in /var/log/auth.log on my Debian server are
Feb 12 16:35:43 remote_host sshd[6738]: Invalid user from 192.168.xx.yy port 26677
Feb 12 16:35:43 remote_host sshd[6738]: input_userauth_request: invalid user [preauth]
Looking closely you can see the double space between user and from in that first line, as seen in your own logs.
answered Feb 12 at 16:35
roaimaroaima
45.1k756122
1
I was able to get around to my testing. It looks like I'm able to log the username attempts now from both internal and external IP addresses. I'm guessing the username being entered in was just a space or empty as @Kusalananda suggested. Thanks for the help everyone!
– veanome
Feb 12 at 17:22
Based on my testing, if the username had been a space you'd have got three adjacent spaces in the log message.
– roaima
Feb 12 at 19:52
add a comment |
fail2ban itself doesn't alter any of the logging processes. It simply reads the logs that get generated. However, I can reproduce the issue as described by specifying a null username:
ssh -l '' remote_host
The corresponding log entries in /var/log/auth.log on my Debian server are
Feb 12 16:35:43 remote_host sshd[6738]: Invalid user from 192.168.xx.yy port 26677
Feb 12 16:35:43 remote_host sshd[6738]: input_userauth_request: invalid user [preauth]
Looking closely you can see the double space between user and from in that first line, as seen in your own logs.
answered Feb 12 at 16:35
roaimaroaima
45.1k756122
fail2ban itself doesn't alter any of the logging processes. It simply reads the logs that get generated. However, I can reproduce the issue as described by specifying a null username:
ssh -l '' remote_host
The corresponding log entries in /var/log/auth.log on my Debian server are
Feb 12 16:35:43 remote_host sshd[6738]: Invalid user from 192.168.xx.yy port 26677
Feb 12 16:35:43 remote_host sshd[6738]: input_userauth_request: invalid user [preauth]
Looking closely you can see the double space between user and from in that first line, as seen in your own logs.
answered Feb 12 at 16:35
roaimaroaima
45.1k756122
answered Feb 12 at 16:35
roaimaroaima
45.1k756122
answered Feb 12 at 16:35
roaimaroaima
45.1k756122
answered Feb 12 at 16:35
roaimaroaima
45.1k756122
45.1k756122
1
I was able to get around to my testing. It looks like I'm able to log the username attempts now from both internal and external IP addresses. I'm guessing the username being entered in was just a space or empty as @Kusalananda suggested. Thanks for the help everyone!
– veanome
Feb 12 at 17:22
Based on my testing, if the username had been a space you'd have got three adjacent spaces in the log message.
– roaima
Feb 12 at 19:52
add a comment |
1
I was able to get around to my testing. It looks like I'm able to log the username attempts now from both internal and external IP addresses. I'm guessing the username being entered in was just a space or empty as @Kusalananda suggested. Thanks for the help everyone!
– veanome
Feb 12 at 17:22
Based on my testing, if the username had been a space you'd have got three adjacent spaces in the log message.
– roaima
Feb 12 at 19:52
1
1
I was able to get around to my testing. It looks like I'm able to log the username attempts now from both internal and external IP addresses. I'm guessing the username being entered in was just a space or empty as @Kusalananda suggested. Thanks for the help everyone!
– veanome
Feb 12 at 17:22
I was able to get around to my testing. It looks like I'm able to log the username attempts now from both internal and external IP addresses. I'm guessing the username being entered in was just a space or empty as @Kusalananda suggested. Thanks for the help everyone!
– veanome
Feb 12 at 17:22
Based on my testing, if the username had been a space you'd have got three adjacent spaces in the log message.
– roaima
Feb 12 at 19:52
Based on my testing, if the username had been a space you'd have got three adjacent spaces in the log message.
– roaima
Feb 12 at 19:52
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f500066%2fcentos-7-invalid-user-from-xx-xx-xx-xx-port-xxx-not-showing-the-attempted%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
fail2bandoesn't alter any of the logging processes. It simply reads the logs that get generated. If the format really did change then something else is responsible. (Do you have any evidence to confirm that the log file used to include the username?)– roaima
Feb 12 at 0:51
Yes, earlier before I installed fail2ban and set the ssh logpath as /var/log/secure, it logged user names.
Feb 11 12:39:54 centos sshd[15331]: Invalid user admin from xx.xx.xx.xx port 51285– veanome
Feb 12 at 1:04
It also looks as though if I connect to my centos box from the internal IP address it will log the username, but if its an external IP address it will not log the username.
– veanome
Feb 12 at 1:11
Sure! I went ahead and made the edits. I'm going to do another restart of the CentOS machine and see if that may fix anything.
– veanome
Feb 12 at 14:58
1
The username used could actually have been empty or a space or tab, possibly in an attempt to confuse or bypass security (which didn't work on your system obviously).
– Kusalananda
Feb 12 at 15:01