SSH not running and will not restart

[NigelP]

I am suppose to have SSH running on an rp7400 server yet when I do a ps -ef and grep sshd it returns only the grep.  I then run /sbin/init.d/secsh start  it displays HP-UX Secure Shell started  run ps -ef and grep sshd it returns only the grep again.

any ideas would be much appriciated

[Pete Randall]

Anything in syslog or dmesg output that would give you a hint?  Check /etc/rc.log to make sure it came up initially, too.

[Denver Osborn]

You should also check the /etc/rc.config.d/sshd file.  Confirm that SSHD_START=1 in /etc/rc.config.d/sshd.  If it is set to 0, the secsh init script will not start sshd.

Using "sh -x" when you run the init script should give you a bit more detail to help you troubleshoot.

sh -x /sbin/init.d/secsh start

-denver

[Steven E. Protter]

Shalom,

Most of the time when this happens to me (and it does) the sshd configuration file is the culprit.

If that is not the case a set -x near the top of the /sbin/init.d/secsh script will do the diagnosis.

If you reach the diagnosis stage post.

swlist -l product | egrep -i "secure|shell"

Post the swlist ouptut to see if secure shell is properly installed.

SEP

[NigelP]

Thanks Guys.

Looking at the syslog, when I have attempted to start ssh it has didplayed Error: Bind to port 22 on 0.0.0.0 failed: Address already in use.  fatal: cannot bind any address.

I then ran

aodxap03:syslog(222)# sh -x /sbin/init.d/secsh start

+ PATH=/usr/sbin:/usr/bin:/sbin:/usr/local/sbin:/usr/local/bin

+ export PATH

+ WHAT=HP-UX Secure Shell

+ WHAT_PATH=/opt/ssh/sbin/sshd

+ WHAT_PID=/var/run/sshd.pid

+ WHAT_CONFIG=/etc/rc.config.d/sshd

+ rval=0

+ [ -f /etc/rc.config.d/sshd ]

+ . /etc/rc.config.d/sshd

+ SSHD_START=1

+ SSHD_ARGS=

+ ps -ef

+ grep /opt/ssh/sbin/sshd

+ grep -v grep

+ 1> /dev/null

+ NOT_RUNNING=1

+ [ 1 -eq 1 -a -x /opt/ssh/sbin/sshd -a 1 -eq 1 ]

+ /opt/ssh/sbin/sshd

+ echo HP-UX Secure Shell started

HP-UX Secure Shell started

+ set_return

+ exit 0

followed by

aodxap03:syslog(223)# swlist -l product | egrep -i "secure|shel"

  Keyshell              B.11.11        Keyshell

  Secure_Shell          A.04.20.004    HP-UX Secure Shell

aodxap03:syslog(224)#

[Pete Randall]

From that output it looks like it might have started this time - at least I don't see any errors.  What does ps -ef  |grep ssh return?

[NigelP]

| grep ssh just returns the grep

[Patrick Wallek]

Do you have lsof installed on the system?  If so, run 'lsof -i tcp:22' to see what process is accessing port 22.

[Pete Randall]

That, by the way, is a pretty old version of Secure Shell.  You might want to consider downloading the current offering (5.80.01):  https://h20392.www2.hp.com/portal/swdepot/try.do?productNumber=T1471AA&lang=EN&cc=EN&hpappid=PDAPI_SWD

[NigelP]

yes I know it's an old version.  if it ain't broke don't fix it! but it may be time to look at upgrading ssh.

[NigelP]

sorry I don't have isof installed and I will not be able to install it

[Denver Osborn]

lsof would really help to identify what (if any) process is listening on port 22... to at least confirm there is already listener preventing sshd from starting, you can use netstat:

netstat -an | awk '/22.*LISTEN/'

That won't show us what process is listening on the port... just that there is already a listener on that port.

You might try telnet to the port to see if it reports what might be running.

telnet localhost 22

If you see an "SSH-version" string returned when you telnet, then sshd is running.  Trying to start it again on the same port would result in the bind error message logged to the syslog.

Still wouldn't explain why you aren't seeing sshd with 'ps -ef |grep sshd'

Good luck,

-denver

[Steven E. Protter]

Shalom,

openssh will update with a simple swinstall command. No need to swremove the old.

Leaving things alone like this is a great way to fail security audits.

People in our job need to be a little more proactive than that. There are major security wholes being found in openssh on a regular basis and this is one of those areas where you want to update periodically.

diag:
netstat -an | grep ":22 "

Please post.

swlist -l bundle | grep OE
# Just wondering what operating environment you are running.

SEP