From owner-freebsd-stable@FreeBSD.ORG Sun Jun 15 11:59:11 2003 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id CE5E937B401 for ; Sun, 15 Jun 2003 11:59:11 -0700 (PDT) Received: from blue.icn.pl (blue.icn.pl [212.182.96.243]) by mx1.FreeBSD.org (Postfix) with SMTP id 9A38643FA3 for ; Sun, 15 Jun 2003 11:59:10 -0700 (PDT) (envelope-from n0n4m3@blue.icn.pl) Received: (qmail 10886 invoked by uid 2074); 15 Jun 2003 18:59:13 -0000 Received: from localhost (sendmail-bs@127.0.0.1) by localhost with SMTP; 15 Jun 2003 18:59:13 -0000 Date: Sun, 15 Jun 2003 20:59:13 +0200 (CEST) From: n0n4m3 To: Scott Lambert In-Reply-To: <20030614053608.GB8466@laptop.lambertfam.org> Message-ID: <20030615205816.Q10766@blue.icn.pl> References: <20030614053608.GB8466@laptop.lambertfam.org> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII cc: FreeBSD STABLE Subject: Re: sshd refusing connections problem X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 15 Jun 2003 18:59:12 -0000 try reinstall sshd install fresh from ports install opensshd latest On Sat, 14 Jun 2003, Scott Lambert wrote: > We have been having a problem with sshd on our shell server. > > This has been happening since March 4, 2003 or before IIRC. Initially I > thought the next OS upgrade, to 4.8 would fix this. I am accustomed to > haveing little things go away in a month or two. > > I think we jumped to 4.7-STABLE on Feb 28, 2003. Some exploit fix > wasn't being MFSd to RELENG_4_7 fast enough for my nerves (cvsd?). It > was last upgraded to FreeBSD 4.8-RELEASE #8: Mon Mar 31 22:13:07 EST > 2003, RELENG_4_8. > > sshd regularly stops accepting new connections. There is never anything > in the logs. This time the last connection before sshd stopped taking > new connections was the user, lets call him "bob" who always manages to > leave a lot of processes with the title of "sshd: bob [priv] (sshd)". > Bob currently has 35 of those processes up. > > Jun 13 19:17:55 shell sshd[39482]: Accepted password for bob from 10.321.321.321 port 3616 > Jun 13 20:28:01 shell sshd[72401]: Received SIGHUP; restarting. > Jun 13 20:28:02 shell sshd[41220]: Server listening on 0.0.0.0 port 22. > Jun 13 21:06:49 shell sshd[42072]: Accepted publickey for scott from 68.160.236.249 > > Obviously, I faked the IP for "bob". > > I consoled in this time and hooked up truss to the server PID. I was > running: > > while true ; do /usr/bin/ssh shell.example.com; done; > > Thinking that if it were a file handle problem, I might accidentally > get in if I caught it as an active user logged out. It was closing the > connection as soon as it was made (TCP handshake). I have, umm, lost > the error messages I was seeing on my side. Hopefully the truss output > will be sufficient. My ssh client never got far enough to negotiate a > key with the server. > > Truss output is at : > > http://www.lambertfam.org/~lambert/sshd_problem/truss_sshd > > netstat -an | grep '\.22 ' output is at : > > http://www.lambertfam.org/~lambert/sshd_problem/netstat-an_sshd > > Faked the first two octets of the other users' IPs. > > Once I -HUP the sshd process and it forks a new daemon, everything is ok > for another week or two. > > -- > Scott Lambert KC5MLE Unix SysAdmin > lambert@lambertfam.org > _______________________________________________ > freebsd-stable@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-stable > To unsubscribe, send any mail to "freebsd-stable-unsubscribe@freebsd.org" >