ProLiant Servers (ML,DL,SL)
cancel
Showing results for 
Search instead for 
Did you mean: 

server Freeze SSH failed

MyriadFrance
Advisor

server Freeze SSH failed

Hello

 

Issue: server freeze, ssh not possible / ping OK only reboot solves the problem

 

I get this problem on several DL servers.

 

After some HP cases I should update my frimware.

 

But for one of my server the ssh is back again after 10days without any actions.

 

Is it possible?Is it linked to the ssh process?

 

Thanks

4 REPLIES
Matti_Kurkela
Honored Contributor

Re: server Freeze SSH failed

Internet-accessible SSH servers are often scanned for by automated malware (worms and botnets). Once a server is found, the malware may make a lot of login attempts with "common" usernames and passwords, in an effort to gain access by bruteforcing a password. Some old SSH versions may have known weaknesses: automated malware may attempt to exploit these weaknesses even if they are not applicable to your SSH version.

 

What is your Operating System? Which version? Is it up to date with patches?

 

What SSH implementation are you using (OpenSSH-based or commercial)? Which version?

 

Can you stop SSH for a while and see if the freeze happens again without it? Or restrict SSH traffic to legitimate endpoints only?

MK
MyriadFrance
Advisor

Re: server Freeze SSH failed

Thanks

 

all these servers are not reachable from outside,there are located in the operator network.

How can i check if there are multiple attempts?

 

info:

Ssh version :

OpenSSH_3.9p1, OpenSSL 0.9.7a Feb 19 2003

 

Bios Version:

  BIOS Information

                Vendor: HP

                Version: P58

                Release Date: 11/08/2006

                Address: 0xF0000

                Runtime Size: 64 kB

                ROM Size: 4096 kB

 

OS:

Red Hat Enterprise Linux ES release 4 (Nahant Update 4)

 

Yours

MyriadFrance
Advisor

Re: server Freeze SSH failed

this can explain?

 

i asked customer to find out what is the server behind this IP:

 

exmaple:/var/log/secure


Sep 11 08:17:57 cg1 sshd[4719]: Accepted password for root from ::ffff:xx.yy.68.103 port 33528 ssh2
Sep 11 08:17:57 cg1 sshd[4720]: Accepted password for root from ::ffff:xx.yy.68.103 port 33528 ssh2
Sep 11 08:27:58 cg1 sshd[10522]: Accepted password for root from ::ffff:xx.yy.68.103 port 51333 ssh2
Sep 11 08:27:58 cg1 sshd[10523]: Accepted password for root from ::ffff:xx.yy.68.103 port 51333 ssh2
Sep 11 08:32:57 cg1 sshd[13569]: Accepted password for root from ::ffff:xx.yy.68.103 port 44384 ssh2
Sep 11 08:32:57 cg1 sshd[13570]: Accepted password for root from ::ffff:xx.yy.68.103 port 44384 ssh2
Sep 11 08:47:57 cg1 sshd[22641]: Accepted password for root from ::ffff:xx.yy.68.103 port 55522 ssh2
Sep 11 08:47:57 cg1 sshd[22642]: Accepted password for root from ::ffff:xx.yy.68.103 port 55522 ssh2
Sep 11 09:02:57 cg1 sshd[31465]: Accepted password for root from ::ffff:xx.yy.68.103 port 37903 ssh2
Sep 11 09:02:57 cg1 sshd[31464]: Accepted password for root from ::ffff:xx.yy.68.103 port 37903 ssh2

MyriadFrance
Advisor

Re: server Freeze SSH failed

xx.yy.68.103 server allowed ,known by the customer