[Bug] SSH login IP anomaly alerts do not work as expected

[mphin]

Contact Information

No response

1Panel Version

v2.3.0

Problem Description

当前问题：未设置白名单，任意IP登录成功达到三次就收到‘SSH 登录 IP 异常告警’，不是应该失败三次才收到通知吗？我又应该如何设置才能达到预期？

之前反馈过类似的问题之后没有再使用面板通知功能了，仅保留SSH通知功能，如今又遇到SSH登录异常困扰，不清楚这是BUG还是和之前反馈的预期逻辑，如果和以前一样那么登录通知逻辑用户非常难理解，没有区分登录成功和登录失败，这方面希望开发者能优化优化。
相关类似问题帖子：
https://bbs.fit2cloud.com/t/topic/18169
https://bbs.fit2cloud.com/t/topic/16232

当前通知设置：

当前告警日志：

当前SSH登录日志：详细日志见最下方（已脱敏）

Steps to Reproduce

未升级v2.3.0前：存在有‘SSH 登录异常告警’告警通知，未添加白名单全部都是默认设置（从未收到过此类通知，未观察功能是否正常）

升级v2.3.0后：新版本右下角快捷终端尝试体验新功能，此时收到‘SSH 登录 IP 异常告警’通知，查看‘登录日志’对应时间节点登录IP是本机公网IP都为登录成功。

随后操作：我以为是通知设置问题，就尝试添加‘SSH 登录异常告警’里的白名单为本机公网IP，后来发现这并不是我想要的设置结果，又把白名单清空了。

目前状况：任意IP登录成功达到三次就收到‘SSH 登录 IP 异常告警’

The expected correct result

1.未设置白名单情况下，任意IP在指定时间内达到指定失败次数则通知。
2.设置白名单的情况下，不在白名单里IP在指定时间内达到指定失败次数则通知。

如果不是这种以上的设计逻辑，那我应该如何设置才能达到预期结果？希望开发者能优化区分成功通知与失败通知

Related log output

2026-09-15T22:20:36.523331+08:00 [SERVER] sshd[4036900]: Accepted publickey for [USER] from [IP_A] port 47138 ssh2: RSA SHA256:[SSH_KEY_FINGERPRINT]
2026-09-15T22:20:36.527185+08:00 [SERVER] sshd[4036900]: pam_unix(sshd:session): session opened for user [USER](uid=0) by (uid=0)
2026-09-15T22:20:37.064356+08:00 [SERVER] sshd[4036900]: pam_env(sshd:session): deprecated reading of user environment enabled
2026-09-15T22:20:37.066930+08:00 [SERVER] sshd[4036900]: fatal: ssh_packet_send_debug: send DEBUG: Broken pipe
2026-09-15T22:20:37.067075+08:00 [SERVER] sshd[4036900]: pam_unix(sshd:session): session closed for user [USER]

2026-09-15T22:20:38.713556+08:00 [SERVER] sshd[4036923]: Accepted publickey for [USER] from [IP_A] port 47140 ssh2: RSA SHA256:[SSH_KEY_FINGERPRINT]
2026-09-15T22:20:38.716954+08:00 [SERVER] sshd[4036923]: pam_unix(sshd:session): session opened for user [USER](uid=0) by (uid=0)
2026-09-15T22:20:38.753225+08:00 [SERVER] sshd[4036923]: pam_env(sshd:session): deprecated reading of user environment enabled
2026-09-15T22:28:17.701746+08:00 [SERVER] sshd[4036923]: pam_unix(sshd:session): session closed for user [USER]
2026-09-15T22:28:51.516092+08:00 [SERVER] sshd[4038462]: Connection closed by [IP_C] port 40608 [preauth]
2026-09-15T22:44:08.678378+08:00 [SERVER] sshd[4040743]: Connection closed by [IP_D] port 43418 [preauth]

2026-09-16T03:40:43.350820+08:00 [SERVER] sshd[4084516]: Accepted publickey for [USER] from [IP_B] port 10797 ssh2: RSA SHA256:[SSH_KEY_FINGERPRINT]
2026-09-16T03:40:43.361128+08:00 [SERVER] sshd[4084516]: pam_unix(sshd:session): session opened for user [USER](uid=0) by (uid=0)
2026-09-16T03:40:43.806517+08:00 [SERVER] sshd[4084516]: pam_env(sshd:session): deprecated reading of user environment enabled
2026-09-16T03:41:02.319512+08:00 [SERVER] sshd[4084689]: Accepted publickey for [USER] from [IP_B] port 10824 ssh2: RSA SHA256:[SSH_KEY_FINGERPRINT]
2026-09-16T03:41:02.322186+08:00 [SERVER] sshd[4084689]: pam_unix(sshd:session): session opened for user [USER](uid=0) by (uid=0)
2026-09-16T03:41:02.377612+08:00 [SERVER] sshd[4084689]: pam_env(sshd:session): deprecated reading of user environment enabled

2026-09-16T03:48:14.582173+08:00 [SERVER] sshd[4085846]: Accepted publickey for [USER] from [IP_B] port 11878 ssh2: RSA SHA256:[SSH_KEY_FINGERPRINT]
2026-09-16T03:48:14.589289+08:00 [SERVER] sshd[4085846]: pam_unix(sshd:session): session opened for user [USER](uid=0) by (uid=0)
2026-09-16T03:48:14.636574+08:00 [SERVER] sshd[4085846]: pam_env(sshd:session): deprecated reading of user environment enabled
2026-09-16T03:48:28.096151+08:00 [SERVER] sshd[4086013]: Accepted publickey for [USER] from [IP_B] port 11891 ssh2: RSA SHA256:[SSH_KEY_FINGERPRINT]
2026-09-16T03:48:28.097463+08:00 [SERVER] sshd[4086013]: pam_unix(sshd:session): session opened for user [USER](uid=0) by (uid=0)
2026-09-16T03:48:28.126940+08:00 [SERVER] sshd[4086013]: pam_env(sshd:session): deprecated reading of user environment enabled

2026-09-16T03:48:48.394227+08:00 [SERVER] sshd[4086189]: Accepted publickey for [USER] from [IP_B] port 11923 ssh2: RSA SHA256:[SSH_KEY_FINGERPRINT]
2026-09-16T03:48:48.399704+08:00 [SERVER] sshd[4086189]: pam_unix(sshd:session): session opened for user [USER](uid=0) by (uid=0)
2026-09-16T03:48:48.438686+08:00 [SERVER] sshd[4086189]: pam_env(sshd:session): deprecated reading of user environment enabled
2026-09-16T03:48:53.488338+08:00 [SERVER] sshd[4086228]: Accepted publickey for [USER] from [IP_B] port 11931 ssh2: RSA SHA256:[SSH_KEY_FINGERPRINT]
2026-09-16T03:48:53.492880+08:00 [SERVER] sshd[4086228]: pam_unix(sshd:session): session opened for user [USER](uid=0) by (uid=0)
2026-09-16T03:48:53.526397+08:00 [SERVER] sshd[4086228]: pam_env(sshd:session): deprecated reading of user environment enabled
2026-09-16T03:48:58.190670+08:00 [SERVER] sshd[4086228]: pam_unix(sshd:session): session closed for user [USER]
2026-09-16T03:48:58.538630+08:00 [SERVER] sshd[4086228]: pam_unix(sshd:session): session closed for user [USER]

2026-09-16T03:49:03.106500+08:00 [SERVER] sshd[4086244]: Connection reset by [IP_B] port 11954 [preauth]
2026-09-16T03:49:03.115195+08:00 [SERVER] sshd[4086236]: pam_unix(sshd:session): session closed for user [USER]
2026-09-16T03:50:07.270371+08:00 [SERVER] sshd[4085846]: pam_unix(sshd:session): session closed for user [USER]
2026-09-16T03:50:07.279914+08:00 [SERVER] sshd[4086189]: pam_unix(sshd:session): session closed for user [USER]
2026-09-16T03:50:07.301871+08:00 [SERVER] sshd[4086013]: pam_unix(sshd:session): session closed for user [USER]

2026-09-16T06:24:49.111069+08:00 [SERVER] sshd[4109456]: Accepted publickey for [USER] from [IP_E] port 37245 ssh2: RSA SHA256:[SSH_KEY_FINGERPRINT]
2026-09-16T06:24:49.122041+08:00 [SERVER] sshd[4109456]: pam_unix(sshd:session): session opened for user [USER](uid=0) by (uid=0)
2026-09-16T06:24:49.491174+08:00 [SERVER] sshd[4109456]: pam_env(sshd:session): deprecated reading of user environment enabled
2026-09-16T06:30:04.174532+08:00 [SERVER] sshd[4109456]: pam_unix(sshd:session): session closed for user [USER]

2026-09-16T18:03:24.562363+08:00 [SERVER] sshd[16928]: Accepted publickey for [USER] from [IP_E] port 35242 ssh2: RSA SHA256:[SSH_KEY_FINGERPRINT]
2026-09-16T18:03:24.567446+08:00 [SERVER] sshd[16928]: pam_unix(sshd:session): session opened for user [USER](uid=0) by (uid=0)
2026-09-16T18:03:24.972437+08:00 [SERVER] sshd[16928]: pam_env(sshd:session): deprecated reading of user environment enabled
2026-09-16T18:03:27.024922+08:00 [SERVER] sshd[16953]: Accepted publickey for [USER] from [IP_E] port 35251 ssh2: RSA SHA256:[SSH_KEY_FINGERPRINT]
2026-09-16T18:03:27.030047+08:00 [SERVER] sshd[16953]: pam_unix(sshd:session): session opened for user [USER](uid=0) by (uid=0)
2026-09-16T18:03:27.064237+08:00 [SERVER] sshd[16953]: pam_env(sshd:session): deprecated reading of user environment enabled
2026-09-16T18:03:27.332759+08:00 [SERVER] sshd[16928]: pam_unix(sshd:session): session closed for user [USER]
2026-09-16T18:03:53.155623+08:00 [SERVER] sshd[16953]: pam_unix(sshd:session): session closed for user [USER]
2026-09-16T18:03:57.249087+08:00 [SERVER] sshd[17335]: Accepted publickey for [USER] from [IP_E] port 35354 ssh2: RSA SHA256:[SSH_KEY_FINGERPRINT]
2026-09-16T18:03:57.254841+08:00 [SERVER] sshd[17335]: pam_unix(sshd:session): session opened for user [USER](uid=0) by (uid=0)
2026-09-16T18:03:57.303839+08:00 [SERVER] sshd[17335]: pam_env(sshd:session): deprecated reading of user environment enabled
2026-09-16T18:07:27.971089+08:00 [SERVER] sshd[20800]: Accepted publickey for [USER] from [IP_E] port 35911 ssh2: RSA SHA256:[SSH_KEY_FINGERPRINT]
2026-09-16T18:07:27.973158+08:00 [SERVER] sshd[20800]: pam_unix(sshd:session): session opened for user [USER](uid=0) by (uid=0)
2026-09-16T18:07:28.020153+08:00 [SERVER] sshd[20800]: pam_env(sshd:session): deprecated reading of user environment enabled
2026-09-16T18:08:33.755502+08:00 [SERVER] sshd[21154]: Accepted publickey for [USER] from [IP_E] port 36032 ssh2: RSA SHA256:[SSH_KEY_FINGERPRINT]
2026-09-16T18:08:33.760315+08:00 [SERVER] sshd[21154]: pam_unix(sshd:session): session opened for user [USER](uid=0) by (uid=0)
2026-09-16T18:08:33.804117+08:00 [SERVER] sshd[21154]: pam_env(sshd:session): deprecated reading of user environment enabled
2026-09-16T18:12:26.250209+08:00 [SERVER] sshd[17335]: pam_unix(sshd:session): session closed for user [USER]
2026-09-16T18:13:21.871655+08:00 [SERVER] sshd[20800]: pam_unix(sshd:session): session closed for user [USER]

2026-09-16T18:24:32.789303+08:00 [SERVER] sshd[23421]: error: kex_exchange_identification: read: Connection reset by peer
2026-09-16T18:24:32.792582+08:00 [SERVER] sshd[23421]: Connection reset by [IP_F] port 1954
2026-09-16T18:24:51.534994+08:00 [SERVER] sshd[23425]: Connection closed by [IP_F] port 43656 [preauth]

2026-09-16T20:21:18.915862+08:00 [SERVER] sshd[21154]: pam_unix(sshd:session): session closed for user [USER]
2026-09-16T23:28:13.399263+08:00 [SERVER] sshd[67272]: Connection closed by [IP_C] port 38530 [preauth]
2026-09-16T23:43:41.094097+08:00 [SERVER] sshd[69519]: Connection closed by [IP_G] port 47454 [preauth]

2026-09-17T02:25:48.958386+08:00 [SERVER] sshd[92980]: Accepted publickey for [USER] from [IP_E] port 34115 ssh2: RSA SHA256:[SSH_KEY_FINGERPRINT]
2026-09-17T02:25:48.966923+08:00 [SERVER] sshd[92980]: pam_unix(sshd:session): session opened for user [USER](uid=0) by (uid=0)
2026-09-17T02:25:49.369119+08:00 [SERVER] sshd[92980]: pam_env(sshd:session): deprecated reading of user environment enabled
2026-09-17T02:27:18.788963+08:00 [SERVER] sshd[92980]: pam_unix(sshd:session): session closed for user [USER]

2026-09-17T02:51:36.793948+08:00 [SERVER] sshd[97642]: Accepted publickey for [USER] from [IP_E] port 36282 ssh2: RSA SHA256:[SSH_KEY_FINGERPRINT]
2026-09-17T02:51:36.797584+08:00 [SERVER] sshd[97642]: pam_unix(sshd:session): session opened for user [USER](uid=0) by (uid=0)
2026-09-17T02:51:37.131761+08:00 [SERVER] sshd[97642]: pam_env(sshd:session): deprecated reading of user environment enabled
2026-09-17T02:54:08.150611+08:00 [SERVER] sshd[97642]: pam_unix(sshd:session): session closed for user [USER]

2026-09-17T02:56:55.372163+08:00 [SERVER] sshd[98440]: Accepted publickey for [USER] from [IP_E] port 36733 ssh2: RSA SHA256:[SSH_KEY_FINGERPRINT]
2026-09-17T02:56:55.374425+08:00 [SERVER] sshd[98440]: pam_unix(sshd:session): session opened for user [USER](uid=0) by (uid=0)
2026-09-17T02:56:55.706830+08:00 [SERVER] sshd[98440]: pam_env(sshd:session): deprecated reading of user environment enabled
2026-09-17T02:57:07.071560+08:00 [SERVER] sshd[98471]: Accepted publickey for [USER] from [IP_E] port 36754 ssh2: RSA SHA256:[SSH_KEY_FINGERPRINT]
2026-09-17T02:57:07.076622+08:00 [SERVER] sshd[98471]: pam_unix(sshd:session): session opened for user [USER](uid=0) by (uid=0)
2026-09-17T02:57:07.120376+08:00 [SERVER] sshd[98471]: pam_env(sshd:session): deprecated reading of user environment enabled
2026-09-17T02:58:03.430950+08:00 [SERVER] sshd[98656]: Accepted publickey for [USER] from [IP_E] port 36828 ssh2: RSA SHA256:[SSH_KEY_FINGERPRINT]
2026-09-17T02:58:03.435940+08:00 [SERVER] sshd[98656]: pam_unix(sshd:session): session opened for user [USER](uid=0) by (uid=0)
2026-09-17T02:58:03.465637+08:00 [SERVER] sshd[98656]: pam_env(sshd:session): deprecated reading of user environment enabled

Additional Information

No response

[lan-yonghui]

@mphin
感谢反馈。目前 SSH 登录告警包含两条规则：

• SSH 登录失败告警:
  统计配置周期内的登录失败次数。例如配置为“30 分钟内登录失败 3 次”，达到阈值后触发“SSH 登录异常告警”。；
• SSH 登录 IP 异常告警:
  系统每分钟检查一次最近 30 分钟内的成功登录记录。只要成功登录的来源 IP 不在白名单中，就会触发“SSH 登录 IP 异常告警”，不受上述“失败 3 次”阈值影响。
  后续会考虑支持默认排除自身可信 IP。现阶段可将常用 IP 或网段加入白名单，避免正常登录触发告警。

[mphin]

@mphin
感谢反馈。目前 SSH 登录告警包含两条规则：

• SSH 登录失败告警:
  统计配置周期内的登录失败次数。例如配置为“30 分钟内登录失败 3 次”，达到阈值后触发“SSH 登录异常告警”。；
• SSH 登录 IP 异常告警:
  系统每分钟检查一次最近 30 分钟内的成功登录记录。只要成功登录的来源 IP 不在白名单中，就会触发“SSH 登录 IP 异常告警”，不受上述“失败 3 次”阈值影响。
  后续会考虑支持默认排除自身可信 IP。现阶段可将常用 IP 或网段加入白名单，避免正常登录触发告警。

谢谢，你把规则列出来现在就一目了然了。
未了解规则的情况下，在面板里设置的时候就一头雾水，新手很不友好，没想到它是存在两种通知，非信任ip登录成功或登录失败