Pete French wrote:
Interesting... I just got another hard lock on the system, not at 3am
this time. The only other common factor in this is that the lockup
is always preceeded by a flood of failed ssh logins. I;m sure we've
all seen these - I get them on every BSD system I have - they look
like this:
Dec 22 17:37:10 turpentine sshd[8188]: error: PAM: authentication error for
illegal user kevin from 61.74.75.43
Dec 22 17:43:21 turpentine sshd[9983]: error: PAM: authentication error for
illegal user kevin from 58.60.106.24
Dec 22 17:49:30 turpentine sshd[11781]: error: PAM: authentication error for
illegal user kevin from 219.234.95.164
Dec 22 18:01:47 turpentine sshd[15435]: error: PAM: authentication error for
illegal user kevin from 61.74.75.43
Dec 22 18:07:54 turpentine sshd[17259]: error: PAM: authentication error for
illegal user kevin from 61.74.75.43
Dec 22 18:14:06 turpentine sshd[19282]: error: PAM: authentication error for
illegal user kevin from 61.74.75.53
Theres always a flood of those on the console immediately preceeding
the lockup. So this time it cant have been anything to do with the
3am run.
When you say "lock up" and "can't login" (in your original mail) - are
you sure this really is a lockup and not e.g. sshd dieing because of the
attacks? E.g. can you ping the machine, can you leave something like
"date >> /root/run.txt && vmstat 1 3 >> /root/run.txt" in crontab so you
track the moment it dies more closely?
_______________________________________________
freebsd-stable@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"
