SSHd audit logs contain UNKNOWN instead of client ip address
Issue
OpenSSHd audit events, which are being logged to /var/log/secure by default, contain UNKNOWN instead of clients ip address for a number of cases, including "Bad protocol version identification" error handling.
Environment
Red Hat Enterprise Linux (RHEL) 5.x, openssh 4.3
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.
