Fixing sshd after someone hosed /var

[yaplej]

We had a problem where one of our vendors wiped out /var and restored from a previous backup. Turns out that the backup was from before I installed ssh.

So now when I try to connect with ssh I get "connection refused" and nothing in the syslog about the connect.

Doing some google I found /sbin/init.d/secsh start but it just tells me.

/var/empty must be owned by root and not group or world-writable.
EXIT CODE: 255

From the bits and pieces I have learned they were trying to cleanup the printers in sam and so tried to do a save/restore of the printer config to make sure its clean.

Doing the restore though apparently caused the printers list to be empty so they restored from tape to get the devices back.

Apparently breaking ssh. Grrr.

So how can I get this fixed? Running "ps -ef | grep sshd" shows me that sshd is still running.

root 19916 24414 1 18:12:22 pts/te 0:00 grep sshd

Thank you.

[yaplej]

I just fixed the permissions on /var/empty and it was able to start correctly. Duh.

[Kapil Jha]

;) nice work dude....
i wish somehow u could assign 10 point to yourself.

BR,
Kapil

[Steven Schweda]

> So now when I try to connect with ssh I get
> "connection refused" and nothing in the
> syslog about the connect.

There's nothing in the log because sshd is
not running ("Connection refused"), so it
can't log anything.

> Running "ps -ef | grep sshd" shows me that
> sshd is still running.
>
> root 19916 24414 1 18:12:22 pts/te 0:00 grep sshd

That's your grep command, not the sshd
itself. What _that_ shows is that sshd is
_not_ running, which is consistent with that
"Connection refused" complaint above.

[yaplej]

Ah woops didnt notice that it was finding the grep command.

[Steven Schweda]

> [...] didnt notice that it was finding the
> grep command.

The usual trick in this case is to use a
simple regular expression which won't match
itself. For example:

grep [s]shd

I find it to be a trick worth remembering.