Date: Mon, 28 Dec 2009 03:21:53 +0100 From: Ivan Voras <ivoras@freebsd.org> To: freebsd-stable@freebsd.org Subject: Re: Disc lock up on 8.0-STABLE Message-ID: <hh94o1$4t7$1@ger.gmane.org> In-Reply-To: <E1NN9XE-0008EM-4Z@dilbert.ticketswitch.com> References: <E1NN9XE-0008EM-4Z@dilbert.ticketswitch.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Pete French wrote: > Interesting... I just got another hard lock on the system, not at 3am > this time. The only other common factor in this is that the lockup > is always preceeded by a flood of failed ssh logins. I;m sure we've > all seen these - I get them on every BSD system I have - they look > like this: > > Dec 22 17:37:10 turpentine sshd[8188]: error: PAM: authentication error for illegal user kevin from 61.74.75.43 > Dec 22 17:43:21 turpentine sshd[9983]: error: PAM: authentication error for illegal user kevin from 58.60.106.24 > Dec 22 17:49:30 turpentine sshd[11781]: error: PAM: authentication error for illegal user kevin from 219.234.95.164 > Dec 22 18:01:47 turpentine sshd[15435]: error: PAM: authentication error for illegal user kevin from 61.74.75.43 > Dec 22 18:07:54 turpentine sshd[17259]: error: PAM: authentication error for illegal user kevin from 61.74.75.43 > Dec 22 18:14:06 turpentine sshd[19282]: error: PAM: authentication error for illegal user kevin from 61.74.75.53 > > Theres always a flood of those on the console immediately preceeding > the lockup. So this time it cant have been anything to do with the > 3am run. When you say "lock up" and "can't login" (in your original mail) - are you sure this really is a lockup and not e.g. sshd dieing because of the attacks? E.g. can you ping the machine, can you leave something like "date >> /root/run.txt && vmstat 1 3 >> /root/run.txt" in crontab so you track the moment it dies more closely?
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?hh94o1$4t7$1>