Suggestion: SSHD pseudo/fake mode. Source available.

[Daniel Kastenholz]

Excuse me, am I missing anything? Usually, developers on open source 
mailing lists complain about the gimme-gimme mentality of the writers 
because otherwise they couldn't handle the many feature requests. That's 
why I tried not to bother you with newbie questions, pointed out the 
missing feature in short, proposed a solution, sent you a clear and 
documented patch as requested, and noticed you that the original version 
doesn't work as expected. All I'm getting back from you is either "do 
this", "do that" or just ignorance. Could it be that you're applying 
double standards here? At least "thanks" would have been nice to hear in 
between. I'm giving this up. Apply the patch or stick to your broken 
solution.

Darren Tucker schrieb:

> Daniel Kastenholz wrote:
>
>> However, the daemon behaves slightly different when the "DenyUsers *" 
>> option is used. By default, sshd disconnects when the third wrong set 
>> of credentials has been provided. With "DenyUsers *", this always 
>> happens after the first attempt.
>
>
> Any such differences in behaviour ought to be found and fixed.
>
> Under what circumstances does this occur?  (Compile options, config 
> options, authentication method, valid/invalid user?)  A quick test 
> here with 3.9p1 shows the same behaviour for password and pubkey 
> authentication (ie sshd just denies the auth attempt and the client 
> can retry, up until the client disconnects or the MaxAuthTries limit 
> is reached).
>
> Could you post the server-side debugging for both instances?
>