记录SSH链接创建过程，Server端日志

Jan 29 11:23:02 user-sicharge sshd[6682]: debug1: Forked child 10348.
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: Set /proc/self/oom_score_adj to 0
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: rexec start in 5 out 5 newsock 5 pipe 7 sock 8
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: inetd sockets after dupping: 4, 4
Jan 29 11:23:02 user-sicharge sshd[10348]: Connection from 10.199.34.74 port 53688 on 10.199.35.15 port 22 rdomain ""
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: Local version string SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.6
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: Remote protocol version 2.0, remote software version MoTTY_Release_0.80
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: compat_banner: no match: MoTTY_Release_0.80
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: permanently_set_uid: 129/65534 [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: list_hostkey_types: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: SSH2_MSG_KEXINIT sent [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: SSH2_MSG_KEXINIT received [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: kex: algorithm: sntrup761x25519-sha512@openssh.com [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: kex: host key algorithm: ssh-ed25519 [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: kex: client->server cipher: aes256-ctr MAC: hmac-sha2-256 compression: zlib@openssh.com [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: kex: server->client cipher: aes256-ctr MAC: hmac-sha2-256 compression: zlib@openssh.com [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: SSH2_MSG_KEX_ECDH_INIT received [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: ssh_packet_send2_wrapped: resetting send seqnr 3 [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: rekey out after 4294967296 blocks [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: SSH2_MSG_NEWKEYS sent [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: Sending SSH2_MSG_EXT_INFO [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: expecting SSH2_MSG_NEWKEYS [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: ssh_packet_read_poll2: resetting read seqnr 3 [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: SSH2_MSG_NEWKEYS received [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: rekey in after 4294967296 blocks [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: KEX done [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: userauth-request for user user service ssh-connection method none [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: attempt 0 failures 0 [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: PAM: initializing for "user"
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: PAM: setting PAM_RHOST to "10.199.34.74"
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: PAM: setting PAM_TTY to "ssh"
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: userauth-request for user user service ssh-connection method publickey [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: attempt 1 failures 0 [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: userauth_pubkey: publickey test pkalg ssh-ed25519 pkblob ED25519 SHA256:v0S66Yu0IAQ5eEdhpAGAzhZR02FgdYSk8+XfeZK2co0 [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: temporarily_use_uid: 1000/1000 (e=0/0)
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: trying public key file /home/user/.ssh/authorized_keys
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: fd 5 clearing O_NONBLOCK
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: /home/user/.ssh/authorized_keys:1: matching key found: ED25519 SHA256:v0S66Yu0IAQ5eEdhpAGAzhZR02FgdYSk8+XfeZK2co0
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: /home/user/.ssh/authorized_keys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
Jan 29 11:23:02 user-sicharge sshd[10348]: Accepted key ED25519 SHA256:v0S66Yu0IAQ5eEdhpAGAzhZR02FgdYSk8+XfeZK2co0 found at /home/user/.ssh/authorized_keys:1
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: restore_uid: 0/0
Jan 29 11:23:02 user-sicharge sshd[10348]: Postponed publickey for user from 10.199.34.74 port 53688 ssh2 [preauth]
Jan 29 11:23:02 user-sicharge sshd[6682]: debug1: Forked child 10350.
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: Set /proc/self/oom_score_adj to 0
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: rexec start in 5 out 5 newsock 5 pipe 8 sock 9
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: userauth-request for user user service ssh-connection method publickey [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: attempt 2 failures 0 [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: temporarily_use_uid: 1000/1000 (e=0/0)
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: trying public key file /home/user/.ssh/authorized_keys
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: fd 5 clearing O_NONBLOCK
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: /home/user/.ssh/authorized_keys:1: matching key found: ED25519 SHA256:v0S66Yu0IAQ5eEdhpAGAzhZR02FgdYSk8+XfeZK2co0
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: /home/user/.ssh/authorized_keys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
Jan 29 11:23:02 user-sicharge sshd[10348]: Accepted key ED25519 SHA256:v0S66Yu0IAQ5eEdhpAGAzhZR02FgdYSk8+XfeZK2co0 found at /home/user/.ssh/authorized_keys:1
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: restore_uid: 0/0
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: inetd sockets after dupping: 4, 4
Jan 29 11:23:02 user-sicharge sshd[10350]: Connection from 10.199.34.74 port 53691 on 10.199.35.15 port 22 rdomain ""
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: Local version string SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.6
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: auth_activate_options: setting new authentication options
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: Remote protocol version 2.0, remote software version SecureBlackbox
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: compat_banner: no match: SecureBlackbox
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: permanently_set_uid: 129/65534 [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: list_hostkey_types: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: SSH2_MSG_KEXINIT sent [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: do_pam_account: called
Jan 29 11:23:02 user-sicharge sshd[10348]: Accepted publickey for user from 10.199.34.74 port 53688 ssh2: ED25519 SHA256:v0S66Yu0IAQ5eEdhpAGAzhZR02FgdYSk8+XfeZK2co0
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: monitor_child_preauth: user user authenticated by privileged process
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: auth_activate_options: setting new authentication options [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: Enabling compression at level 6. [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: monitor_read_log: child log fd closed
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: PAM: establishing credentials
Jan 29 11:23:02 user-sicharge sshd[10348]: pam_unix(sshd:session): session opened for user user(uid=1000) by (uid=0)
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: SSH2_MSG_KEXINIT received [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: kex: algorithm: diffie-hellman-group-exchange-sha256 [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: kex: host key algorithm: ssh-ed25519 [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: kex: client->server cipher: aes256-ctr MAC: hmac-sha1 compression: none [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: kex: server->client cipher: aes256-ctr MAC: hmac-sha1 compression: none [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: expecting SSH2_MSG_KEX_DH_GEX_REQUEST [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received [preauth]
Jan 29 11:23:02 user-sicharge systemd-logind[707]: New session 606 of user user.
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: SSH2_MSG_KEX_DH_GEX_INIT received [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: rekey out after 4294967296 blocks [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: SSH2_MSG_NEWKEYS sent [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: expecting SSH2_MSG_NEWKEYS [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: SSH2_MSG_NEWKEYS received [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: rekey in after 4294967296 blocks [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: KEX done [preauth]
Jan 29 11:23:02 user-sicharge sshd[10348]: User child is on pid 10388
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: SELinux support disabled
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: PAM: establishing credentials
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: permanently_set_uid: 1000/1000
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: rekey in after 4294967296 blocks
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: rekey out after 4294967296 blocks
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: ssh_packet_set_postauth: called
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: Enabling compression at level 6.
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: active: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: Entering interactive session for SSH2.
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: server_init_dispatch
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: server_input_channel_open: ctype session rchan 256 win 16384 max 16384
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: input_session_request
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: channel 0: new [server-session]
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: session_new: session 0
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: session_open: channel 0
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: session_open: session 0: link with channel 0
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: server_input_channel_open: confirm session
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: userauth-request for user user service ssh-connection method none [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: attempt 0 failures 0 [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: PAM: initializing for "user"
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: PAM: setting PAM_RHOST to "10.199.34.74"
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: PAM: setting PAM_TTY to "ssh"
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: server_input_channel_req: channel 0 request x11-req reply 1
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: session_by_channel: session 0 channel 0
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: session_input_channel_req: session 0 req x11-req
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: channel 1: new [X11 inet listener]
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: channel 2: new [X11 inet listener]
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: server_input_channel_req: channel 0 request pty-req reply 1
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: session_by_channel: session 0 channel 0
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: session_input_channel_req: session 0 req pty-req
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: Allocating pty.
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: session_new: session 0
Jan 29 11:23:02 user-sicharge sshd[10348]: debug1: SELinux support disabled
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: session_pty_req: session 0 alloc /dev/pts/0
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: server_input_channel_req: channel 0 request shell reply 1
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: session_by_channel: session 0 channel 0
Jan 29 11:23:02 user-sicharge sshd[10388]: debug1: session_input_channel_req: session 0 req shell
Jan 29 11:23:02 user-sicharge sshd[10388]: Starting session: shell on pts/0 for user from 10.199.34.74 port 53688 id 0
Jan 29 11:23:02 user-sicharge sshd[10389]: debug1: Setting controlling tty using TIOCSCTTY.
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: userauth-request for user user service ssh-connection method publickey [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: attempt 1 failures 0 [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: userauth_pubkey: publickey test pkalg ssh-ed25519 pkblob ED25519 SHA256:v0S66Yu0IAQ5eEdhpAGAzhZR02FgdYSk8+XfeZK2co0 [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: temporarily_use_uid: 1000/1000 (e=0/0)
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: trying public key file /home/user/.ssh/authorized_keys
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: fd 5 clearing O_NONBLOCK
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: /home/user/.ssh/authorized_keys:1: matching key found: ED25519 SHA256:v0S66Yu0IAQ5eEdhpAGAzhZR02FgdYSk8+XfeZK2co0
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: /home/user/.ssh/authorized_keys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
Jan 29 11:23:02 user-sicharge sshd[10350]: Accepted key ED25519 SHA256:v0S66Yu0IAQ5eEdhpAGAzhZR02FgdYSk8+XfeZK2co0 found at /home/user/.ssh/authorized_keys:1
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: restore_uid: 0/0
Jan 29 11:23:02 user-sicharge sshd[10350]: Postponed publickey for user from 10.199.34.74 port 53691 ssh2 [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: userauth-request for user user service ssh-connection method publickey [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: attempt 2 failures 0 [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: temporarily_use_uid: 1000/1000 (e=0/0)
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: trying public key file /home/user/.ssh/authorized_keys
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: fd 5 clearing O_NONBLOCK
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: /home/user/.ssh/authorized_keys:1: matching key found: ED25519 SHA256:v0S66Yu0IAQ5eEdhpAGAzhZR02FgdYSk8+XfeZK2co0
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: /home/user/.ssh/authorized_keys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
Jan 29 11:23:02 user-sicharge sshd[10350]: Accepted key ED25519 SHA256:v0S66Yu0IAQ5eEdhpAGAzhZR02FgdYSk8+XfeZK2co0 found at /home/user/.ssh/authorized_keys:1
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: restore_uid: 0/0
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: auth_activate_options: setting new authentication options
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: do_pam_account: called
Jan 29 11:23:02 user-sicharge sshd[10350]: Accepted publickey for user from 10.199.34.74 port 53691 ssh2: ED25519 SHA256:v0S66Yu0IAQ5eEdhpAGAzhZR02FgdYSk8+XfeZK2co0
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: monitor_child_preauth: user user authenticated by privileged process
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: auth_activate_options: setting new authentication options [preauth]
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: monitor_read_log: child log fd closed
Jan 29 11:23:02 user-sicharge sshd[10350]: debug1: PAM: establishing credentials
Jan 29 11:23:02 user-sicharge sshd[10350]: pam_unix(sshd:session): session opened for user user(uid=1000) by (uid=0)
Jan 29 11:23:02 user-sicharge systemd-logind[707]: New session 607 of user user.
Jan 29 11:23:02 user-sicharge sshd[10350]: User child is on pid 10434
Jan 29 11:23:02 user-sicharge sshd[10434]: debug1: SELinux support disabled
Jan 29 11:23:02 user-sicharge sshd[10434]: debug1: PAM: establishing credentials
Jan 29 11:23:02 user-sicharge sshd[10434]: debug1: permanently_set_uid: 1000/1000
Jan 29 11:23:02 user-sicharge sshd[10434]: debug1: rekey in after 4294967296 blocks
Jan 29 11:23:02 user-sicharge sshd[10434]: debug1: rekey out after 4294967296 blocks
Jan 29 11:23:02 user-sicharge sshd[10434]: debug1: ssh_packet_set_postauth: called
Jan 29 11:23:02 user-sicharge sshd[10434]: debug1: active: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
Jan 29 11:23:02 user-sicharge sshd[10434]: debug1: Entering interactive session for SSH2.
Jan 29 11:23:02 user-sicharge sshd[10434]: debug1: server_init_dispatch
Jan 29 11:23:02 user-sicharge sshd[10434]: debug1: server_input_channel_open: ctype session rchan 1 win 32768 max 262144
Jan 29 11:23:02 user-sicharge sshd[10434]: debug1: input_session_request
Jan 29 11:23:02 user-sicharge sshd[10434]: debug1: channel 0: new [server-session]
Jan 29 11:23:02 user-sicharge sshd[10434]: debug1: session_new: session 0
Jan 29 11:23:02 user-sicharge sshd[10434]: debug1: session_open: channel 0
Jan 29 11:23:02 user-sicharge sshd[10434]: debug1: session_open: session 0: link with channel 0
Jan 29 11:23:02 user-sicharge sshd[10434]: debug1: server_input_channel_open: confirm session
Jan 29 11:23:03 user-sicharge sshd[10434]: debug1: server_input_channel_req: channel 0 request subsystem reply 1
Jan 29 11:23:03 user-sicharge sshd[10434]: debug1: session_by_channel: session 0 channel 0
Jan 29 11:23:03 user-sicharge sshd[10434]: debug1: session_input_channel_req: session 0 req subsystem
Jan 29 11:23:03 user-sicharge sshd[10434]: debug1: subsystem: exec() /usr/lib/openssh/sftp-server
Jan 29 11:23:03 user-sicharge sshd[10434]: Starting session: subsystem 'sftp' for user from 10.199.34.74 port 53691 id 0