Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Secure-Shell
[Top] [All Lists]

Openssh on NCR MP-RAS - millions of accept errors

Subject: Openssh on NCR MP-RAS - millions of accept errors
Date: Tue, 15 Nov 2005 15:08:07 +0200
Hi folks

I am trying to get Openssh 4.1p1 running on an NCR Unix MP-RAS server. It seems to be working fine, except it started logging millions of errors to the syslog daemon (which does not know how to summarise i.e. "repeated 100000 times")

This ended up filling up the log partition (6 GB, in short order!)

Here is an example of the error message:

Nov  3 11:07:37 sshd[1565]: error: accept: No such device or address

This error seems to map back to errno.h ENXIO == 6, but I couldn't find that error in the openssh source anywhere.

I have restarted the SSH daemon, and it seems to be behaving itself, for the moment.

Does anyone have any idea what may have caused this?

Could it possibly be anything to do with an interface being downed? The machine in question does have multiple interfaces, but the sshd_config file is the stock-standard config that comes with openssh, and it is listening on the defaults:

#Port 22
#Protocol 2,1
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

Does it seem possible that an accept loop could get into such a state, by changing the interface status?

Many thanks for any suggestions.

Rogan

<Prev in Thread] Current Thread [Next in Thread>
  • Openssh on NCR MP-RAS - millions of accept errors, Rogan Dawes <=