[PVE-User] Wrong ip logged

[elmer]

Hello,

I get SSH connections attempts to one of my VM. But in the logs of the VM,
it's the ip(W.X.Y.Z) of the host proxmox server. Although the attempts come
from outside.


Mar  1 10:03:10 bespin sshd[28919]: pam_unix(sshd:auth): authentication
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=W.X.Y.Z
Mar  1 10:03:07 bespin sshd[28917]: pam_unix(sshd:auth): authentication
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=W.X.Y.Z
Mar  1 10:03:05 bespin sshd[28914]: pam_unix(sshd:auth): authentication
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=W.X.Y.Z
Mar  1 10:03:03 bespin sshd[28912]: pam_unix(sshd:auth): authentication
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=W.X.Y.Z
Mar  1 10:03:00 bespin sshd[28910]: pam_unix(sshd:auth): authentication
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=W.X.Y.Z
Mar  1 10:02:58 bespin sshd[28908]: pam_unix(sshd:auth): authentication
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=W.X.Y.Z
Mar  1 10:02:55 bespin sshd[28906]: pam_unix(sshd:auth): authentication
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=W.X.Y.Z

Did I configure something wrong or is it normal ? Maybe because the host and
the VM share the same kernel/netfilter/vmbr ? Is there any solutions or
rules I could apply to solve it or to rewrite the source ip's before it's
logged?

For information, the vm is bridged with the physical etherned card of the
host proxmox server (vmbr0).

Thank you

elmer
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.proxmox.com/pipermail/pve-user/attachments/20100301/aef6753e/attachment.htm>