Logfile encoding question

[Darren Tucker]

On Mon, Feb 13, 2017 at 5:12 PM, Andrey Klimentev
<andrei650816 at gmail.com> wrote:
> Hello.
>
> I've got a question about encoding in sshd's log files.
>
> When I try to log in with a "х" username, which is a cyrillic "h" (U+0445),
> I get this message in a logfile: input_userauth_request: invalid user
> \\321\\205 [preauth].

I'ts run through strnvis[1] with some options with different options
depending on whether it's going to syslog or stderr, but both include
VIS_OCTAL so that should be what anything unusual ends up as.

That said, assuming what you posted is exactly what it logged, it
looks to me as if it was sent the literal string "\321\205" and sshd
just escaped the backslashes.  Are you sure the client is sending what
you think it's sending?

In log.c:

#define LOG_SYSLOG_VIS (VIS_CSTYLE|VIS_NL|VIS_TAB|VIS_OCTAL)
#define LOG_STDERR_VIS (VIS_SAFE|VIS_OCTAL)
[...]
strnvis(fmtbuf, msgbuf, sizeof(fmtbuf),
   log_on_stderr ? LOG_STDERR_VIS : LOG_SYSLOG_VIS);

[1] http://man.openbsd.org/OpenBSD-current/man3/vis.3

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860  37F4 9357 ECEF 11EA A6FA (new)
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.