topic Re: Fixing sshd after someone hosed /var in Operating System - HP-UX

Fixing sshd after someone hosed /var

yaplej — Thu, 05 Aug 2010 00:13:38 GMT

We had a problem where one of our vendors wiped out /var and restored from a previous backup. Turns out that the backup was from before I installed ssh.

So now when I try to connect with ssh I get "connection refused" and nothing in the syslog about the connect.

Doing some google I found /sbin/init.d/secsh start but it just tells me.

/var/empty must be owned by root and not group or world-writable.
EXIT CODE: 255

From the bits and pieces I have learned they were trying to cleanup the printers in sam and so tried to do a save/restore of the printer config to make sure its clean.

Doing the restore though apparently caused the printers list to be empty so they restored from tape to get the devices back.

Apparently breaking ssh. Grrr.

So how can I get this fixed? Running "ps -ef | grep sshd" shows me that sshd is still running.

root 19916 24414 1 18:12:22 pts/te 0:00 grep sshd

Thank you.

Re: Fixing sshd after someone hosed /var

yaplej — Thu, 05 Aug 2010 01:14:58 GMT

I just fixed the permissions on /var/empty and it was able to start correctly. Duh.

Re: Fixing sshd after someone hosed /var

Kapil Jha — Thu, 05 Aug 2010 01:28:03 GMT

;) nice work dude....
i wish somehow u could assign 10 point to yourself.

BR,
Kapil

Re: Fixing sshd after someone hosed /var

Steven Schweda — Thu, 05 Aug 2010 01:43:36 GMT

> So now when I try to connect with ssh I get
> "connection refused" and nothing in the
> syslog about the connect.

There's nothing in the log because sshd is
not running ("Connection refused"), so it
can't log anything.

> Running "ps -ef | grep sshd" shows me that
> sshd is still running.
>
> root 19916 24414 1 18:12:22 pts/te 0:00 grep sshd

That's your grep command, not the sshd
itself. What _that_ shows is that sshd is
_not_ running, which is consistent with that
"Connection refused" complaint above.

Re: Fixing sshd after someone hosed /var

yaplej — Mon, 09 Aug 2010 02:56:46 GMT

Ah woops didnt notice that it was finding the grep command.

Re: Fixing sshd after someone hosed /var

Steven Schweda — Mon, 09 Aug 2010 04:03:31 GMT

> [...] didnt notice that it was finding the
> grep command.

The usual trick in this case is to use a
simple regular expression which won't match
itself. For example:

grep [s]shd

I find it to be a trick worth remembering.