From owner-freebsd-current@FreeBSD.ORG  Thu Nov 16 23:24:53 2006
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
X-Original-To: current@freebsd.org
Delivered-To: freebsd-current@FreeBSD.ORG
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id DD21216A412
	for <current@freebsd.org>; Thu, 16 Nov 2006 23:24:53 +0000 (UTC)
	(envelope-from thompsa@freebsd.org)
Received: from alias2.ihug.co.nz (alias2.ihug.co.nz [203.96.222.12])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 793AC43D45
	for <current@freebsd.org>; Thu, 16 Nov 2006 23:24:53 +0000 (GMT)
	(envelope-from thompsa@freebsd.org)
Received: from ironport3.ihug.co.nz [203.109.254.23] 
	by alias2.ihug.co.nz with esmtp (Exim 3.36 #1 (Debian))
	id 1GkqZL-0005G2-00; Fri, 17 Nov 2006 12:22:55 +1300
Received: from 203-109-251-39.static.bliink.ihug.co.nz (HELO heff.fud.org.nz)
	([203.109.251.39])
	by ironport3.ihug.co.nz with ESMTP; 17 Nov 2006 12:25:14 +1300
X-Ironport-Seen: Yes
Received: by heff.fud.org.nz (Postfix, from userid 1001)
	id AFD0E1CC29; Fri, 17 Nov 2006 12:24:50 +1300 (NZDT)
Date: Fri, 17 Nov 2006 12:24:50 +1300
From: Andrew Thompson <thompsa@freebsd.org>
To: current@freebsd.org
Message-ID: <20061116232450.GA16087@heff.fud.org.nz>
Mail-Followup-To: Andrew Thompson <thompsa@freebsd.org>,
	current@freebsd.org
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.11
Cc: 
Subject: audit records
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>, 
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 16 Nov 2006 23:24:53 -0000

Hi,


I thought i'd try out the new audit system and simulate an invalid login.
I was suprised to see that ssh connections to localhost show up as
255.255.255.255, is this an error?

% ssh df@localhost
header,94,10,OpenSSH login,0,Fri Nov 17 12:16:44 2006, + 100 msec
subject,-1,-1,-1,-1,-1,1378,1378,60666,255.255.255.255
text,invalid user name "df"
return,failure : No such process,4294967295
trailer,94

% ssh df@192.168.0.182
header,95,10,OpenSSH login,0,Fri Nov 17 12:17:26 2006, + 892 msec
subject,-1,-1,-1,-1,-1,1385,1385,58511,192.168.0.182
text,invalid user name "df"
return,failure : No such process,4294967295
trailer,95



Andrew