不确定身份验证日志中的日志消息中的值意味着什么？

Question

我的 auth.log 文件中有以下日志行项目。

[TimeStamp] [server] sshd[####]: Received disconnect from [IP Address]: 11: disconnected by user

显然，这是 ssh 会话的断开连接日志。我知道除了 11 之外的所有含义。这个值表示什么？此日志消息的形式是否记录在某处？

Answer 1

这是断开连接的原因代码。从来源:

/* disconnect reason code */

#define SSH2_DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT     1
#define SSH2_DISCONNECT_PROTOCOL_ERROR                  2
#define SSH2_DISCONNECT_KEY_EXCHANGE_FAILED             3
#define SSH2_DISCONNECT_HOST_AUTHENTICATION_FAILED      4
#define SSH2_DISCONNECT_RESERVED                        4
#define SSH2_DISCONNECT_MAC_ERROR                       5
#define SSH2_DISCONNECT_COMPRESSION_ERROR               6
#define SSH2_DISCONNECT_SERVICE_NOT_AVAILABLE           7
#define SSH2_DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED  8
#define SSH2_DISCONNECT_HOST_KEY_NOT_VERIFIABLE         9
#define SSH2_DISCONNECT_CONNECTION_LOST                 10
#define SSH2_DISCONNECT_BY_APPLICATION                  11
#define SSH2_DISCONNECT_TOO_MANY_CONNECTIONS            12
#define SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER          13
#define SSH2_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE  14
#define SSH2_DISCONNECT_ILLEGAL_USER_NAME               15

Answer 2

查看该线上方。您是否看到类似“未收到来自”的标识字符串或类似内容？他们很可能正在发起攻击。