[GH-ISSUE #2693] why does frpc client generate so many /var/log/secure attemp logging?

gitea-mirror commented

2026-05-05 13:22:57 -06:00

Owner

Originally created by @ANDYGE on GitHub (Dec 7, 2021).
Original GitHub issue: https://github.com/fatedier/frp/issues/2693

Bug Description

I deploy a frpc in my local centos，But I found the /var/log/secure grow so fast, some line as below:

Dec 8 07:12:36 serverJGD sshd[25862]: Invalid user ha from 127.0.0.1 port 44152
Dec 8 07:12:36 serverJGD sshd[25862]: input_userauth_request: invalid user ha [preauth]
Dec 8 07:12:36 serverJGD sshd[25862]: pam_unix(sshd:auth): check pass; user unknown
Dec 8 07:12:36 serverJGD sshd[25862]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=serverjgd
Dec 8 07:12:37 serverJGD sshd[25859]: Failed password for invalid user ha from 127.0.0.1 port 44150 ssh2
Dec 8 07:12:37 serverJGD sshd[25859]: Received disconnect from 127.0.0.1 port 44150:11: Normal Shutdown, Thank you for playing [preauth]
Dec 8 07:12:37 serverJGD sshd[25859]: Disconnected from 127.0.0.1 port 44150 [preauth]
Dec 8 07:12:38 serverJGD sshd[25865]: Invalid user ha from 127.0.0.1 port 44154
Dec 8 07:12:38 serverJGD sshd[25865]: input_userauth_request: invalid user ha [preauth]
Dec 8 07:12:38 serverJGD sshd[25865]: pam_unix(sshd:auth): check pass; user unknown
Dec 8 07:12:38 serverJGD sshd[25865]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=serverjgd
Dec 8 07:12:38 serverJGD sshd[25862]: Failed password for invalid user ha from 127.0.0.1 port 44152 ssh2
Dec 8 07:12:39 serverJGD sshd[25868]: Invalid user hebdt from 127.0.0.1 port 44156
Dec 8 07:12:39 serverJGD sshd[25868]: input_userauth_request: invalid user hebdt [preauth]
Dec 8 07:12:39 serverJGD sshd[25868]: pam_unix(sshd:auth): check pass; user unknown
Dec 8 07:12:39 serverJGD sshd[25868]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=serverjgd
Dec 8 07:12:39 serverJGD sshd[25862]: Received disconnect from 127.0.0.1 port 44152:11: Normal Shutdown, Thank you for playing [preauth]
Dec 8 07:12:39 serverJGD sshd[25862]: Disconnected from 127.0.0.1 port 44152 [preauth]

does someone has meet the same question and how to solve it?

thanks

frpc Version

0.37.0

frps Version

0.37.0

System Architecture

x86_64

Configurations

[common]
server_addr = XXXX
server_port = 9000
token = xxxx

[ssh]
type = tcp
local_ip = 127.0.0.1
local_port = 22
remote_port = 6000

Logs

No response

Steps to reproduce

...

Affected area

Docs
Installation
Performance and Scalability
Security
User Experience
Test and Release
Developer Infrastructure
Client Plugin
Server Plugin
Extensions
Others

Originally created by @ANDYGE on GitHub (Dec 7, 2021). Original GitHub issue: https://github.com/fatedier/frp/issues/2693 ### Bug Description I deploy a frpc in my local centos，But I found the /var/log/secure grow so fast, some line as below: Dec 8 07:12:36 serverJGD sshd[25862]: Invalid user ha from 127.0.0.1 port 44152 Dec 8 07:12:36 serverJGD sshd[25862]: input_userauth_request: invalid user ha [preauth] Dec 8 07:12:36 serverJGD sshd[25862]: pam_unix(sshd:auth): check pass; user unknown Dec 8 07:12:36 serverJGD sshd[25862]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=serverjgd Dec 8 07:12:37 serverJGD sshd[25859]: Failed password for invalid user ha from 127.0.0.1 port 44150 ssh2 Dec 8 07:12:37 serverJGD sshd[25859]: Received disconnect from 127.0.0.1 port 44150:11: Normal Shutdown, Thank you for playing [preauth] Dec 8 07:12:37 serverJGD sshd[25859]: Disconnected from 127.0.0.1 port 44150 [preauth] Dec 8 07:12:38 serverJGD sshd[25865]: Invalid user ha from 127.0.0.1 port 44154 Dec 8 07:12:38 serverJGD sshd[25865]: input_userauth_request: invalid user ha [preauth] Dec 8 07:12:38 serverJGD sshd[25865]: pam_unix(sshd:auth): check pass; user unknown Dec 8 07:12:38 serverJGD sshd[25865]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=serverjgd Dec 8 07:12:38 serverJGD sshd[25862]: Failed password for invalid user ha from 127.0.0.1 port 44152 ssh2 Dec 8 07:12:39 serverJGD sshd[25868]: Invalid user hebdt from 127.0.0.1 port 44156 Dec 8 07:12:39 serverJGD sshd[25868]: input_userauth_request: invalid user hebdt [preauth] Dec 8 07:12:39 serverJGD sshd[25868]: pam_unix(sshd:auth): check pass; user unknown Dec 8 07:12:39 serverJGD sshd[25868]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=serverjgd Dec 8 07:12:39 serverJGD sshd[25862]: Received disconnect from 127.0.0.1 port 44152:11: Normal Shutdown, Thank you for playing [preauth] Dec 8 07:12:39 serverJGD sshd[25862]: Disconnected from 127.0.0.1 port 44152 [preauth] does someone has meet the same question and how to solve it? thanks ### frpc Version 0.37.0 ### frps Version 0.37.0 ### System Architecture x86_64 ### Configurations [common] server_addr = XXXX server_port = 9000 token = xxxx [ssh] type = tcp local_ip = 127.0.0.1 local_port = 22 remote_port = 6000 ### Logs _No response_ ### Steps to reproduce 1. 2. 3. ... ### Affected area - [ ] Docs - [ ] Installation - [ ] Performance and Scalability - [ ] Security - [ ] User Experience - [ ] Test and Release - [ ] Developer Infrastructure - [ ] Client Plugin - [ ] Server Plugin - [ ] Extensions - [ ] Others

gitea-mirror

2026-05-05 13:22:57 -06:00

closed this issue
added the
lifecycle/stale
label

gitea-mirror commented

2026-05-05 13:23:00 -06:00

Author

Owner

@Wronthyou-Emme commented on GitHub (Dec 28, 2021):

Hello!
I think that you should configure [log] in your frpc.ini.

# console or real logFile path like ./frpc.log
log_file = ./frpc.log

# trace, debug, info, warn, error
log_level = info

log_max_days = 3

# disable log colors when log_file is console, default is false
disable_log_color = false

You can find more in frpc_full.ini

@Wronthyou-Emme commented on GitHub (Dec 28, 2021): Hello! I think that you should configure [log] in your frpc.ini. " ``` # console or real logFile path like ./frpc.log log_file = ./frpc.log # trace, debug, info, warn, error log_level = info log_max_days = 3 # disable log colors when log_file is console, default is false disable_log_color = false ``` " You can find more in frpc_full.ini

gitea-mirror commented

2026-05-05 13:23:01 -06:00

Author

Owner

@github-actions[bot] commented on GitHub (Jan 28, 2022):

Issues go stale after 30d of inactivity. Stale issues rot after an additional 7d of inactivity and eventually close.

@github-actions[bot] commented on GitHub (Jan 28, 2022): Issues go stale after 30d of inactivity. Stale issues rot after an additional 7d of inactivity and eventually close.