topic Re: Mysterious telnetd spawning in Operating System - HP-UX

Mysterious telnetd spawning

Bernie Vande Griend — Thu, 27 Sep 2001 14:43:35 GMT

One of our 11i systems is set up to allow 300 telnet sessions. There were 170 users telneted in, when suddenly no one else could telnet it and we started getting "Telnet device drivers missing" errors.

I found that there were 300 telnetd processes spawned. 170 were valid, but 130 of these were spawned at the same time and did not have a tty associated with it. I killed these off and all was fine again.

Any ideas of how this could have happened?
I can see a few coming from telnet session not terminated correctly, but not sure how so many could happen at once. This has not happened before, but the system was just upgraded (cold install) to 11i a couple days ago.

Re: Mysterious telnetd spawning

linuxfan — Thu, 27 Sep 2001 15:10:20 GMT

Hi Bernie,

Do you have logging enabled for inetd?
If you just want to enable inetd temporarily(this won't be set upon subsequent reboots, but if you want to enable logging on reboots to then modify /etc/rc.config.d/netdaemons and add "-l" to INETD_ARGS)

inetd -k
inetd -l

This will enable logging in your /var/adm/syslog/syslog.log for your inetd daemon, and you can check where the telnet connections are coming from, but this will increase your file size, so keep an eye on the log file.

Since this was the first occurance, not sure if it will happen again or not but you will atleast be better prepared if it does.

-Regards
Ramesh

Re: Mysterious telnetd spawning

Bernie Vande Griend — Thu, 27 Sep 2001 15:33:34 GMT

Ramesh,
I did not have it enabled. Not sure I'd want it enabled normally, but its a great idea to turn it on for awhile and see if it happens again, if it does I will at least know where it came from. Thanks.

Re: Mysterious telnetd spawning

Steve Post — Thu, 27 Sep 2001 19:14:15 GMT

I saw this happen at my site too. Here's my GUESS: There is something that uses telnet to periodically connect to your system. The thing is able to handle networking one direction only, into the HP box. It bangs into the system, grabs a port, can't do anything with it, so it grabs another port. It cycles like this until it grabs all of the telnet ports available.
Like I said. This is a GUESS. My incident came from a little program was a dos batch file in an infinite loop from an NT box.
But I can't prove anything yet. The error very rarely happens.

Steve