From owner-freebsd-stable@FreeBSD.ORG  Wed Mar 19 16:01:49 2014
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 77F89182
 for <freebsd-stable@freebsd.org>; Wed, 19 Mar 2014 16:01:49 +0000 (UTC)
Received: from mail-pa0-x233.google.com (mail-pa0-x233.google.com
 [IPv6:2607:f8b0:400e:c03::233])
 (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits))
 (No client certificate requested)
 by mx1.freebsd.org (Postfix) with ESMTPS id 39B25A89
 for <freebsd-stable@freebsd.org>; Wed, 19 Mar 2014 16:01:49 +0000 (UTC)
Received: by mail-pa0-f51.google.com with SMTP id kq14so9099531pab.24
 for <freebsd-stable@freebsd.org>; Wed, 19 Mar 2014 09:01:48 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=mime-version:sender:in-reply-to:references:date:message-id:subject
 :from:to:cc:content-type;
 bh=6fEEHbcj3zranjEvYu+JnQTsVZuwhYO751k1e0MMCeg=;
 b=T+Kutjc30R26Tye8sRx276SuqyL0i9ZD1y9AVKZ3IzI1Ju2/BTIn+t7sANxpLnvdfc
 bxG9Z3VM0CHsmm5Pzs92Tl9syP5LRMHSINh/J4jMw/eXz2GzcoRYOpKkxcwLtHiY5aOC
 ChatK6Gif3/8XgUqbs8SJEwz/jVuvpXcaq1ol0sdVCYtDgqqXhjRTZxqyHLrwalUcZod
 8fI9Dj0nW+qevcGheuv4ol2+5KXYBVoqq+pqxPw10U0PC5bn0htSjlPDkAex/fhVeekI
 iCEZk8JVCK9umhfOMQsttPehPTsEfXPT8YoHjjh8D6MR0kTDuLAm7g4NBERImwf+mHVW
 fuSw==
MIME-Version: 1.0
X-Received: by 10.66.156.137 with SMTP id we9mr41403278pab.30.1395244908880;
 Wed, 19 Mar 2014 09:01:48 -0700 (PDT)
Sender: kob6558@gmail.com
Received: by 10.66.0.164 with HTTP; Wed, 19 Mar 2014 09:01:48 -0700 (PDT)
In-Reply-To: <532994EA.9090300@bsdinfo.com.br>
References: <53016D97.5030909@bsdinfo.com.br> <53066B59.5000709@yandex.ru>
 <531A6C66.2010101@bsdinfo.com.br>
 <CAPJF9wnVOYjTXB0A1wyzwvCj-Tvx_u2uYLW72-wDuz-QZpwT4w@mail.gmail.com>
 <53298445.90706@bsdinfo.com.br> <532994EA.9090300@bsdinfo.com.br>
Date: Wed, 19 Mar 2014 09:01:48 -0700
X-Google-Sender-Auth: 89Yeuv1rdqxtDxh5efai39JSNZE
Message-ID: <CAN6yY1uucfkdXxkCF30w1Q9vffRpDLxM90Sz1XVbdn5W69vQMg@mail.gmail.com>
Subject: Re: sshd with zombie process on FreeBSD 10.0-STABLE - workaround
From: Kevin Oberman <rkoberman@gmail.com>
To: Marcelo Gondim <gondim@bsdinfo.com.br>
Content-Type: text/plain; charset=UTF-8
X-Content-Filtered-By: Mailman/MimeDel 2.1.17
Cc: FreeBSD Stable Mailing List <freebsd-stable@freebsd.org>
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable/>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 19 Mar 2014 16:01:49 -0000

On Wed, Mar 19, 2014 at 6:00 AM, Marcelo Gondim <gondim@bsdinfo.com.br>wrote:

> Hi all,
>
> While the solution does not appear, did the script below and put it in
> crontab to automatically delete zombie sshd processes.
>
> the_walking_dead.sh:
>
> #!/bin/sh
> kill -9 `ps afx|grep sshd|grep unknown|awk '{print $1}'`
>
>
> Put this in /etc/crontab:
>
> 00 1 * * *    root    the_walking_dead.sh
>
>
If 'kill -9' works, the process is not really a zombie. It simply still has
a socket open and is waiting for it to be closed before exiting.

You might takes a look at network sockets with sockstat(1) and see if you
can get any indication of why these sockets are not being closed. It may be
that the issue is not sshd but some other issue in the OS leaving sockets
open.

-- 
R. Kevin Oberman, Network Engineer, Retired
E-mail: rkoberman@gmail.com