VanDyke emails appearing logs

[redhatnation]

Hi VanDyke,

While working in a lab, I spotted these entries in a log. What are these email addresses and why do they appear when I try to authenticate against a remote server?

Oct 26 08:32:11 dns1 sftp-server[15535]: error: Unknown extended request "fs-multiple-roots-supported@vandyke.com"
Oct 26 08:32:11 dns1 sftp-server[15535]: error: Unknown extended request "vendor-id"
Oct 26 08:50:36 dns1 sshd[15735]: Accepted keyboard-interactive/pam for <MYUSERNAME> from <MYIP> port 54927 ssh2
Oct 26 08:51:20 dns1 sshd[15738]: subsystem request for publickey@vandyke.com by user <MYUSERNAME> failed, subsystem not found

It might be a mis-config on my part, I admit, but the email addresses have me curious.

(I was SSHing from a Win10 Pro client running SecureCRT 8.1.4 to a FreeBSD server running 11.1.)

[bgagnon]

Hi redhatnation,

These messages are innocuous, and should not be cause for any alarm. Here's what's going on with these messages, one by one:

> Oct 26 08:32:11 dns1 sftp-server[15535]: error: Unknown extended request "fs-multiple-roots-supported@vandyke.com"

Your sftp server implementation is indicating that the sftp client (SecureCRT/SecureFX) is asking the server whether or not it supports an extension to the SFTP protocol named fs-multiple-roots-supported@vandyke.com.

(If not aware, SecureCRT includes SFTP support. An SFTP tab can be connected if the remote server supports SFTP by right-clicking a connected SSH2 session and choosing Connect SFTP Session.)

Compliant SFTP server implementations should effectively ignore protocol extensions that are unknown or otherwise unsupported.

More information about this interaction can be found by reading the detailed explanation in the Vendor-Specific Extensions section of the SFTP protocol specification. Being FreeBSD, it is likely that your server is based on OpenSSH. OpenSSH only implements up to SFTP version 3, so that would be documented here:

https://tools.ietf.org/html/draft-ie...fer-02#page-24

Regarding the other extension your server is reporting...

> Oct 26 08:32:11 dns1 sftp-server[15535]: error: Unknown extended request "vendor-id"

This is another extension request that our clients send to an SFTP server. If supported, our clients would have provided additional information as described in this extension -- one of the many documented online here:

https://tools.ietf.org/html/draft-ie...-extensions-00

Similarly for the last line:

> Oct 26 08:51:20 dns1 sshd[15738]: subsystem request for publickey@vandyke.com by user <MYUSERNAME> failed, subsystem not found

While there may or may not be an app for that, I know there is an RFC for that as well!

https://tools.ietf.org/html/rfc4819

Does this information help answer your question, and assuage any concerns about the messages you're seeing in your sftp server's log?

[redhatnation]

Originally Posted by bgagnon

Hi redhatnation,

[snip for space]

Does this information help answer your question, and assuage any concerns about the messages you're seeing in your sftp server's log?

Hi Brenda,

Thank you for the fast and thorough response. I was more curious than anything when I saw those email addresses and had to ask. You've certainly addressed my curiosity. Thank you!

-redhatnation