Seeing ::ffff:<ip address> in auth.log files

tensigh · 04-28-2006, 11:17 PM

Hi all.

I recently have been seeing a change in my auth.log files. Sites used to show up just as the IP address, such as:

'Apr 28 20:34:48 mail sshd[9409]: Accepted password for <user> from <address> port 4342 ssh2'

but now I'm getting an ::ffff: with the IP address:

'Apr 28 20:34:48 mail sshd[9409]: Accepted password for <user> from ::ffff:<address> port 4342 ssh2'

Anybody know what's running that adds the hex address? I'm running authfail on the system and now authfail doesn't work because of the addt'l info. At least, I think that's why it's not running.

Thanks

bulliver · 05-01-2006, 11:43 AM

::ffff: looks like an ipv6 address, though it is not a valid one...
Can you tell which ipv4 ip address this connection was from?

tensigh · 05-01-2006, 11:48 AM

My face is red! I should have figured that out. Once I removed ipv6 and rebooted everything worked fine. Authfail is now kicking out failed attempts to log in to my server. Thanks for replying.