fix(sftp): no connection-log row for connections that never sign in #17

2026-10-15T12:15:46Z

KofTwentyTwo commented

2026-10-15 12:15:46 +00:00

(Migrated from github.com)

Found during the kof22 SFTP go-live checks (cluster-gitops#105).

The connection-log row was inserted at TCP accept, with a provisional AUTH_FAILED. The kubelet's TCP readiness probe on the SFTP port opens and closes a connection every 5 seconds per pod. So prod recorded a no-username "failed sign-in" every 5 seconds per pod, about 35k rows a day. That flooded the Connections list and the failure numbers.

Fix: the row is now written at the first authentication attempt, or at a pre-auth refusal such as the per-IP connection rate limit. Connections that never try to sign in (health probes, port scans) leave no row. The per-IP rate limit is still counted at accept. DESIGN §7 is updated.

Test: three bare TCP connects leave no rows, and a real unknown-key attempt then writes exactly one AUTH_FAILED row. 101 tests pass.

For 0.1.0-RC.4. Until RC.4 is deployed, kof22 can point the gateway's readiness probe at the HTTP port to stop the flood.

🤖 Generated with Claude Code

Found during the kof22 SFTP go-live checks (cluster-gitops#105). The connection-log row was inserted at TCP accept, with a provisional `AUTH_FAILED`. The kubelet's TCP readiness probe on the SFTP port opens and closes a connection every 5 seconds per pod. So prod recorded a no-username "failed sign-in" every 5 seconds per pod, about 35k rows a day. That flooded the Connections list and the failure numbers. **Fix:** the row is now written at the first authentication attempt, or at a pre-auth refusal such as the per-IP connection rate limit. Connections that never try to sign in (health probes, port scans) leave no row. The per-IP rate limit is still counted at accept. DESIGN §7 is updated. **Test:** three bare TCP connects leave no rows, and a real unknown-key attempt then writes exactly one `AUTH_FAILED` row. 101 tests pass. For 0.1.0-RC.4. Until RC.4 is deployed, kof22 can point the gateway's readiness probe at the HTTP port to stop the flood. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-file-gateway#17