On Fri 10 Sep 2021 at 08:11:02 (-0400), Greg Wooledge wrote: > On Fri, Sep 10, 2021 at 10:33:47AM +0100, Adam Weremczuk wrote:
> > Weeks later it happened again and I'm not any less puzzled: > > All right, now we're getting somewhere. > > Is it possible that these lines are being remotely syslogged to you from > another host? … as I suggested Aug 16¹, and I haven't changed my view. In fact, the OP stated that they were running openssh 7.9p1-10+deb10u2 on Debian 10.10, but the objectionable configuration options as defaults were last seen in stretch, and even jessie (KeyRegenerationInterval and ServerKeyBits). Presumably, this other host is contacted "maybe 2-3 times per month", hence the frequency of being logged by logwatch. ¹ https://lists.debian.org/debian-user/2021/08/msg00882.html Cheers, David.