From owner-freebsd-stable@FreeBSD.ORG  Mon Dec 28 02:22:18 2009
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id BA2EA1065742
	for <freebsd-stable@freebsd.org>; Mon, 28 Dec 2009 02:22:18 +0000 (UTC)
	(envelope-from freebsd-stable@m.gmane.org)
Received: from lo.gmane.org (lo.gmane.org [80.91.229.12])
	by mx1.freebsd.org (Postfix) with ESMTP id 76D948FC15
	for <freebsd-stable@freebsd.org>; Mon, 28 Dec 2009 02:22:18 +0000 (UTC)
Received: from list by lo.gmane.org with local (Exim 4.50) id 1NP5FP-00067j-0r
	for freebsd-stable@freebsd.org; Mon, 28 Dec 2009 03:22:15 +0100
Received: from 26-58.dsl.iskon.hr ([89.164.26.58])
	by main.gmane.org with esmtp (Gmexim 0.1 (Debian))
	id 1AlnuQ-0007hv-00
	for <freebsd-stable@freebsd.org>; Mon, 28 Dec 2009 03:22:15 +0100
Received: from ivoras by 26-58.dsl.iskon.hr with local (Gmexim 0.1 (Debian))
	id 1AlnuQ-0007hv-00
	for <freebsd-stable@freebsd.org>; Mon, 28 Dec 2009 03:22:15 +0100
X-Injected-Via-Gmane: http://gmane.org/
To: freebsd-stable@freebsd.org
From: Ivan Voras <ivoras@freebsd.org>
Date: Mon, 28 Dec 2009 03:21:53 +0100
Lines: 23
Message-ID: <hh94o1$4t7$1@ger.gmane.org>
References: <E1NN9XE-0008EM-4Z@dilbert.ticketswitch.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Complaints-To: usenet@ger.gmane.org
X-Gmane-NNTP-Posting-Host: 26-58.dsl.iskon.hr
User-Agent: Thunderbird 2.0.0.23 (X11/20090817)
In-Reply-To: <E1NN9XE-0008EM-4Z@dilbert.ticketswitch.com>
Sender: news <news@ger.gmane.org>
Subject: Re: Disc lock up on 8.0-STABLE
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>, 
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Dec 2009 02:22:18 -0000

Pete French wrote:
> Interesting... I just got another hard lock on the system, not at 3am
> this time. The only other common factor in this is that the lockup
> is always preceeded by a flood of failed ssh logins. I;m sure we've
> all seen these - I get them on every BSD system I have - they look
> like this:
> 
> Dec 22 17:37:10 turpentine sshd[8188]: error: PAM: authentication error for illegal user kevin from 61.74.75.43
> Dec 22 17:43:21 turpentine sshd[9983]: error: PAM: authentication error for illegal user kevin from 58.60.106.24
> Dec 22 17:49:30 turpentine sshd[11781]: error: PAM: authentication error for illegal user kevin from 219.234.95.164
> Dec 22 18:01:47 turpentine sshd[15435]: error: PAM: authentication error for illegal user kevin from 61.74.75.43
> Dec 22 18:07:54 turpentine sshd[17259]: error: PAM: authentication error for illegal user kevin from 61.74.75.43
> Dec 22 18:14:06 turpentine sshd[19282]: error: PAM: authentication error for illegal user kevin from 61.74.75.53
> 
> Theres always a flood of those on the console immediately preceeding
> the lockup. So this time it cant have been anything to do with the
> 3am run.

When you say "lock up" and "can't login" (in your original mail) - are 
you sure this really is a lockup and not e.g. sshd dieing because of the 
attacks? E.g. can you ping the machine, can you leave something like 
"date >> /root/run.txt && vmstat 1 3 >> /root/run.txt" in crontab so you 
track the moment it dies more closely?