4 files changed, 32 insertions, 9 deletions

diff --git a/auth-options.c b/auth-options.c
index e387697d3..f1e3ddfdf 100644
--- a/auth-options.c
+++ b/auth-options.c
@@ -58,9 +58,20 @@ int forced_tun_device = -1;
 /* "principals=" option. */
 char *authorized_principals = NULL;
 
+/* Throttle log messages. */
+int logged_from_hostip = 0;
+int logged_cert_hostip = 0;
+
 extern ServerOptions options;
 
 void
+auth_start_parse_options(void)
+{
+        logged_from_hostip = 0;
+        logged_cert_hostip = 0;
+}
+
+void
 auth_clear_options(void)
 {
         no_agent_forwarding_flag = 0;
@@ -293,10 +304,13 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
                                 /* FALLTHROUGH */
                         case 0:
                                 free(patterns);
-                                logit("Authentication tried for %.100s with "
-                                    "correct key but not from a permitted "
-                                    "host (host=%.200s, ip=%.200s).",
-                                    pw->pw_name, remote_host, remote_ip);
+                                if (!logged_from_hostip) {
+                                        logit("Authentication tried for %.100s with "
+                                            "correct key but not from a permitted "
+                                            "host (host=%.200s, ip=%.200s).",
+                                            pw->pw_name, remote_host, remote_ip);
+                                        logged_from_hostip = 1;
+                                }
                                 auth_debug_add("Your host '%.200s' is not "
                                     "permitted to use this key for login.",
                                     remote_host);
@@ -519,11 +533,14 @@ parse_option_list(struct sshbuf *oblob, struct passwd *pw,
                                         break;
                                 case 0:
                                         /* no match */
-                                        logit("Authentication tried for %.100s "
-                                            "with valid certificate but not "
-                                            "from a permitted host "
-                                            "(ip=%.200s).", pw->pw_name,
-                                            remote_ip);
+                                        if (!logged_cert_hostip) {
+                                                logit("Authentication tried for %.100s "
+                                                    "with valid certificate but not "
+                                                    "from a permitted host "
+                                                    "(ip=%.200s).", pw->pw_name,
+                                                    remote_ip);
+                                                logged_cert_hostip = 1;
+                                        }
                                         auth_debug_add("Your address '%.200s' "
                                             "is not permitted to use this "
                                             "certificate for login.",
diff --git a/auth-options.h b/auth-options.h
index 34852e5c0..1653855ee 100644
--- a/auth-options.h
+++ b/auth-options.h
@@ -33,6 +33,7 @@ extern int forced_tun_device;
 extern int key_is_cert_authority;
 extern char *authorized_principals;
 
+void    auth_start_parse_options(void);
 int     auth_parse_options(struct passwd *, char *, char *, u_long);
 void    auth_clear_options(void);
 int     auth_cert_options(struct sshkey *, struct passwd *);
diff --git a/auth-rsa.c b/auth-rsa.c
index cbd971be1..4cf2163c7 100644
--- a/auth-rsa.c
+++ b/auth-rsa.c
@@ -181,6 +181,8 @@ rsa_key_allowed_in_file(struct passwd *pw, char *file,
         if ((f = auth_openkeyfile(file, pw, options.strict_modes)) == NULL)
                 return 0;
 
+        auth_start_parse_options();
+
         /*
          * Go though the accepted keys, looking for the current key.  If
          * found, perform a challenge-response dialog to verify that the
diff --git a/auth2-pubkey.c b/auth2-pubkey.c
index 5aa319ccc..1eee16168 100644
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -561,6 +561,7 @@ process_principals(FILE *f, char *file, struct passwd *pw,
         u_long linenum = 0;
         u_int i;
 
+        auth_start_parse_options();
         while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
                 /* Skip leading whitespace. */
                 for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
@@ -726,6 +727,7 @@ check_authkeys_file(FILE *f, char *file, Key* key, struct passwd *pw)
         found_key = 0;
 
         found = NULL;
+        auth_start_parse_options();
         while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
                 char *cp, *key_options = NULL;
                 if (found != NULL)
@@ -872,6 +874,7 @@ user_cert_trusted_ca(struct passwd *pw, Key *key)
         if (key_cert_check_authority(key, 0, 1,
             use_authorized_principals ? NULL : pw->pw_name, &reason) != 0)
                 goto fail_reason;
+        auth_start_parse_options();
         if (auth_cert_options(key, pw) != 0)
                 goto out;