NetBSD Problem Report #60506

From www@netbsd.org  Sun Jul 26 02:54:36 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 66A0F1A923C
	for <gnats-bugs@gnats.NetBSD.org>; Sun, 26 Jul 2026 02:54:36 +0000 (UTC)
Message-Id: <20260726025435.10D7B1A923D@mollari.NetBSD.org>
Date: Sun, 26 Jul 2026 02:54:34 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: default syslog.conf spams console with ssh/http attacks
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60506
>Category:       bin
>Synopsis:       default syslog.conf spams console with ssh/http attacks
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Jul 26 02:55:00 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, 9, ...
>Organization:
The NetBSD Spamdation, Inconsolate
>Environment:
>Description:

	The default /etc/syslog.conf has the following line:

*.err;kern.*;auth.notice;authpriv.none;mail.crit	/dev/console

	The `auth.notice' and `*.err' parts mean that:

	- ssh login failures get logged to the console
	- bogus requests to bozohttpd get logged to the console

	For a host on the internet with ssh access and an http server,
	that's a lot of spam on the console.

	I think these are bad defaults.  They lead to warning fatigue
	and, under load like a network denial of service attack that
	prevents ssh access, make the console unusable for diagnostics
	and remediation of the load.

	I have run into this repeatedly lately with TNF's own
	infrastructure for the repository migration, so for the new
	infrastructure I've already set it up to deploy a quieter
	console.

>How-To-Repeat:

	1. run sshd and bozohttpd (or apache2/nginx with syslog)
	2. connect to the internet

>Fix:

	Change it to:

*.err;kern.*;auth.none;ftp.none;authpriv.none;mail.crit	/dev/console

	I.e., replace auth.notice by auth.none, and add ftp.none.  This
	way, the *.err pattern won't match ssh login faliures or bad
	http requests.

Home	PR Database Search