ssh: don't log health checks and port probes as failed sign-ins

A connection that never sends a byte is a probe (Hammerhead health-checks every
TCP resource that way), so it is no longer logged every 30 seconds.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

sshd/sshd.go

@@ -18,6 +18,7 @@ import (
 	"os"
 	"path/filepath"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"golang.org/x/crypto/ssh"
@@ -143,9 +144,14 @@ func (s *Server) Serve(ctx context.Context, ln net.Listener) error {
 func (s *Server) handle(ctx context.Context, nc net.Conn) {
 	defer nc.Close()
 	nc.SetDeadline(time.Now().Add(handshakeTimeout))
-	conn, chans, reqs, err := ssh.NewServerConn(nc, s.conf)
+	rc := &readCounter{Conn: nc}
+	conn, chans, reqs, err := ssh.NewServerConn(rc, s.conf)
 	if err != nil {
-		s.cfg.Logf("ssh: sign-in from %s failed: %v", nc.RemoteAddr(), err)
+		// A client that connects and never says anything is a port probe or a health check (Hammerhead
+		// checks every TCP resource this way), not a failed sign-in, so it is not worth a log line each time.
+		if rc.n.Load() > 0 {
+			s.cfg.Logf("ssh: sign-in from %s failed: %v", nc.RemoteAddr(), err)
+		}
 		return
 	}
 	nc.SetDeadline(time.Time{})
@@ -172,6 +178,18 @@ func (s *Server) handle(ctx context.Context, nc net.Conn) {
 	wg.Wait()
 }
 
+// readCounter counts the bytes a client has sent.
+type readCounter struct {
+	net.Conn
+	n atomic.Int64
+}
+
+func (r *readCounter) Read(p []byte) (int, error) {
+	n, err := r.Conn.Read(p)
+	r.n.Add(int64(n))
+	return n, err
+}
+
 type ptyReq struct {
 	term       string
 	cols, rows uint32