Hi,
My test environment is an embedded Linux system, zeek is installed on it. Normally, when I login this Linux system through SSH login from MacBook, zeek will record it (set “auth_success” as true, and “auth_attempts” as 1/2/3…).
But, when I switch to another ubuntu PC , zeek cannot detect the login behavior( no setting of “auth_succcess” and “auth_attempts”). But I really login successfully.
Does anybody meet this phenomenon before? Is it related with some network settings (network cable is same) ? Thanks in advance.
below two log texts show the difference:
capture login success: {“ts":1587136399.660159,“uid”:“CqXaOV38H6o0d1PAdj”,“id.orig_h”:“172.20.1.200”,“id.orig_p”:56832,“id.resp_h”:“172.20.1.1”,“id.resp_p”:22,“version”:2,“auth_success”:true,“auth_attempts”:3,“client”:“SSH-2.0-OpenSSH_8.1”,“server”:“SSH-2.0-OpenSSH_8.2”,“cipher_alg”:"chacha20-poly1305@openssh.com”,“mac_alg”:"umac-64-etm@openssh.com",“compression_alg”:“none”,“kex_alg”:“curve25519-sha256”,“host_key_alg”:“ecdsa-sha2-nistp256”,“host_key”:“d1:0f:fe:e0:9d:29:6f:09:3e:0d:01:e4:08:5a:c9:cf”}
miss the SSH login:
{“ts”:1672707699.768357,“uid”:“CreMM74BoZSyinWHXf”,“id.orig_h”:“172.20.1.200”,“id.orig_p”:41712,“id.resp_h”:“172.20.1.1”,“id.resp_p”:22,“version”:2,“auth_attempts”:0,“client”:“SSH-2.0-OpenSSH_8.1”,“server”:“SSH-2.0-OpenSSH_8.2”}