sshd terminated abnormaly.

[Manoj Sivan]

Hi Experts,

My linux server was working fine since long days and today we faced sshd deamon terminated abnormaly and no one was able to login. Same time it was able to communicate to other servres using ssh.

OS Version : Red Hat Enterprise Linux AS release 3 (Taroon Update 6)

i found some abnormal entries in /var/log/secure. During the time i found server in OS hang state (No login from console). Restart resolves the issue.It happeded twice.

Please help to find out the root cause.

==============================================

Mar 28 09:14:40 bksrv3 xinetd[3427]: START: auth pid=1702 from=16.173.24.100
Mar 28 09:18:56 bksrv3 sshd[3411]: Received signal 15; terminating.
Mar 28 09:18:56 bksrv3 sshd[2042]: Server listening on 0.0.0.0 port 22.

ar 28 10:11:38 bksrv3 sshd[2042]: Received signal 15; terminating.
Mar 28 10:26:05 bksrv3 sshd[4722]: Server listening on 0.0.0.0 port 22.
Mar 28 10:27:39 bksrv3 xinetd[4738]: START: sgi_fam pid=7076 from=
Mar 28 10:29:02 bksrv3 sshd[7528]: Did not receive identification string from 16.173.24.177

=================================================

Thanks and Regards

Manoj

[Ivan Ferreira]

You should enable remote loogging in syslog, like this:

authpriv,daemon.debug @remote_host.domain

If the system is hang, maybe cannot log the problem.

Also, enable install the sysstat package and check with sar the status of the system at the time of the hang.

You may enable magic sysrq to generate a memory dump. Server hang is hard to troubleshoot, maybe you have a problem with a module. If you have support contract, try RHN.

[Huc_1]

Perhaps you should find more info on this by looking at /var/log/messages for time around 14:30 down ?

Signal 15 killed SSHD ? Who/what gave this signal

Who is log in at that time perhaps command last can help here !

tell us more on this if it is secure to do so

Jean-Pierre

[Steven E. Protter]

Shalom Manoj,

Could this be the user is not authenticating?

rpm -qa | grep openssh

A new version of openssh might help, though it can be a pain to install.

SEP

[Senthil Kumar .A_1 · Accepted solution]

Hi Manoj,


Mar 28 09:18:56 bksrv3 sshd[3411]: Received signal 15; terminating.


The above message suggests that, someone had opened a "ssh" session from local box to "bksrv3" while suddenly, the server "bksrv3" seemed to have rebooted, before the ssh session got terminated. Hence "bksrv3" seemed to have sent the terminating signal to the local sshd daemon.

To figure out the root cause, try finding out, what happened to the server "bksrv3" at exactly.. "Mar 28 09:18:56"....

Regards,
Senthil Kumar .A

[Patrice Le Guyader]

Hi,

Have you tried to kill it and start it in debug mode and without daemon mode ?

/usr/sbin/sshd -dddd -D

you can perhaps launch the ssh client on the other host in debug mode too.

/usr/sbin/ssh -vvvv server_ssh

hope this helps
Pat

[Manoj Sivan]

Hi All,

Thanks for the advices. Since after that hung it never repeated. /var/messages and secure is silent other than what i pasted.

I want to share with you guys, that i turned off audit deamon during reboot after system hung, since one of the server that was the reason for system hung.

Still couldnt find out the reason for the sshd termination.

Regards

Manoj