Re: QAUDJRN entry for failed password attempts with SSH

[DrFranken <midrange@xxxxxxxxxxxx>]

Vern,

Well I do suspect that it's in PASE but we start it these days with 
STRTCPSVR *SSHD and it runs as job QP0ZSPWP in QUSRWRK.  As I mention 
though it DOES log failed password attempts for VALID user profiles. It 
doesn't log ANYTHING if the profile doesn't exist.


        - Larry "DrFranken" Bolhuis

www.Frankeni.com
www.iDevCloud.com - Personal Development IBM i timeshare service.
www.iInTheCloud.com - Commercial IBM i Cloud Hosting.

On 8/18/2015 2:59 PM, Vernon Hamberg wrote:

> Larry - is SSH running in PASE? If so, I would not expect much in the
> audit journal, as PASE knows nothing about that. It's like those who
> want exit points for sftp and all.
>
> But PASE (AIX) might have some logging of this kind of thing - that a
> WAG for sure on my part.
>
> Vern
>
> On 8/18/2015 1:39 PM, DrFranken wrote:
> > I get these for TELNET (Code T Type PW)
> > I get these for FTP
> > I get these for the http: *ADMIN server
> > I get them with System i Navigator
> >
> > I get them with SSH *IF* they are attempting a VALID user profile.
> >
> > I get NOTHING with SSH if they try root or admin etc. Anyone know
> > where I can turn that on or where to look for this type of failed
> > attempt to authenticate with SSH on i?
> >
> > In this case I'm testing on i 7.1