Re: [expert] sshd server problem - HELP!

[Tibbetts, Ric]

Actually, that does make some sense. I had recently upgraded ssh, and this was it's first crash since. So that's at least a plausable explanation. Thanks!

I've been digging around on the box, and don't see any signs of intrusion. So I don't believe it was hacked (unless someone just has a really twisted sense of humor, that hacked past the firewall, onto the box, deleted the sshd user, and then left, covering all their tracks along the way... lol.

There was also a backup copy of /etc/passwd sitting in /etc/passwd- The "-" makes it look like an automated upgrade, backup copy. So your explanation makes sense.


Thanks again!

Ric

James Sparenberg wrote:

Had this happen once on my home box.  The only thing I could conclude
was that it had something to do with the journal or some other redundant
protection... Same situation a box that went down suddenly do to power
failure. (the lightning strike popped the UPS but didn't get to the
server.) When it restarted the passwd file had apparently been restored
from either the shadow or another form of redundancy that didn't have
the ssh user.  (This was the first restart on this box since ssh had
been upgraded.) End result the ssh user was gone.  Don't know if this
helps in any way but... it's a thought.

James


On Wed, 2003-01-08 at 07:53, Tibbetts, Ric wrote:

Toshiro wrote:

Linux Server sitting in Seattle, I'm in Florida.
The Linux Server crashed due to a power failure (I know, it needs a
UPS). When the server came back up, it came up, sans sshd. So I

cannot

get on it to check it out. I also cannot get on to diagnose the

problem

with sshd, because ssh is my only access (kinda a catch-22 isn't

it?).

Is the server doing anything at all? My first guess is filesystem
corruption with errors that require human intervention (it happened to me a

couple

of times).
Ask someone to look at the console to see if that's what happened.

What I always do in your situation (remote box) is to configure a

serial

console so I can see what's going on when problems arise

THanks!

I have this one solved. "Somehow" (I'm still investigating "how"), the

sshd user had gotten deleted. sshd will not run without it.

Once I restored that (with the help of my remote fingers), all

returned

to normal.

Ric


______________________________________________________________________

Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com

------------------------------------------------------------------------

Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com

Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com