IP address 'UNKNOWN' in host sshd auth.log when SSH socket is directed to a container

Connor Bell

10/23/22, 10:59 AM

I'm using joshuamkite's terraform-aws-ssh-bastion-service, which sets up an SSH socket with systemd that directs SSH connections to a docker container.

I have been attempting to set up fail2ban along with this service to assist with the insane amount of SSH requests these public boxes get daily. Unfortunately, with this setup it seems that auth.log doesn't know about the IP address:

sshd[32094]: Failed password for root from UNKNOWN port 65535 ssh2
sshd[41614]: Accepted publickey for cbell from UNKNOWN port 65535 ssh2: RSA SHA256:xxxx

The socket name itself is correctly named with the IP, so I'm not sure why it's being stripped in auth.log.

[email protected]:22-88.xxx.xxx.66:12437.service: Main process exited, code=exited, status=255/EXCEPTION

Screenshots from the repository show that auth.log did show IP addresses in late 2018, so something has changed since then.

Why is auth.log not correctly reporting IP addresses of connections?

Some potentially relevant versions:

OpenSSH_8.2p1 Ubuntu-4ubuntu0.2, OpenSSL 1.1.1f  31 Mar 2020
Ubuntu 20.04.2 LTS
systemd 245 (245.4-4ubuntu3.6)
+PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD +IDN2 -IDN +PCRE2 default-hierarchy=hybrid

0 + 0

ubuntu

ssh

socket

fail2ban

docker

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: IP address 'UNKNOWN' in host sshd auth.log when SSH socket is directed to a container

TH: ที่อยู่ IP 'ไม่รู้จัก' ในโฮสต์ sshd auth.log เมื่อซ็อกเก็ต SSH ถูกส่งไปยังคอนเทนเนอร์

RO: Adresa IP „NECUNOSCUT” în host sshd auth.log când socket-ul SSH este direcționat către un container

RU: IP-адрес «НЕИЗВЕСТНО» в хосте sshd auth.log, когда сокет SSH направлен на контейнер

VI: Địa chỉ IP 'UNKNOWN' trong máy chủ sshd auth.log khi ổ cắm SSH được chuyển hướng đến vùng chứa

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.