New Log Messages?

[Damien Miller]

On Fri, 3 Jan 2014, Bob Proulx wrote:

> I am always hesitant to mention version numbers upstream because I am
> using a software distribution and as you know software distributions
> support a single release for the lifetime of the distro's stable
> release.  I am running Debian Stable on my internet facing machines.
> For Debian it is about two years.  For me this is perfect.
> 
> In private mail I had someone point me to this serverfault question.
> Apparently I was not the only one who noticed this change and was
> asking questions about it.  (shrug)
> 
>   http://serverfault.com/questions/559200/what-does-normal-shutdown-thank-you-for-playing-preauth-in-ssh-logs-mean
> 
> And the answer proposed seems reasonable.  That the disconnect message
> wasn't logged by sshd previously and now it is being logged.  In your
> upstream sources this could have been a change any time in the last
> two years.  I only made the upgrade on my machines last summer from a
> 5.x release to a 6.x release.  I have been noticing these for some
> months but just finally decided to ask about it.

The message has been there basically forever:

1.41  (markus 02-Jan-01): log("Received disconnect from %s: %d: %.400s", ...

The only thing to have changed semi-recently is that we improved
logging of preauthentication messages in privsep mode in the 5.9
release to no longer need a /dev/log inside the privsep chroot. If
your old OpenSSH version was <5.9 and the /var/empty chroot didn't
have a /dev/log in it then you may have been missing these messages.

-d