Aight, thanks Seth for the execsnoop link, excellent stuff to have in
your tool-box. I just re-ran my test-case, and this is the new strace
output, with the correlating execsnoop snippet.
select(5, [3 4], [], NULL, NULL) = 1 (in [4])
read(4, "\0\0\0\1\v", 1024) = 5
select(5, [3 4], [4], NULL, NULL) = 1 (out [4])
write(4, "\0\0\1<\f\0\0\0\1\0\0\1\27\0\0\0\7ssh-rsa\0\0\0\3\1\0\1\0"..., 320) =
320
select(5, [3 4], [], NULL, NULL) = 1 (in [4])
read(4, "\0\0\2\231\r\0\0\1\27\0\0\0\7ssh-rsa\0\0\0\3\1\0\1\0\0\1\1\0"...,
1024) = 669
select(5, [3 4], [4], NULL, NULL) = 1 (out [4])
write(4, "\0\0\1\24\16\0\0\1\17\0\0\0\7ssh-rsa\0\0\1\0z4DFM\312_\377"..., 280)
= 280
select(5, [3 4], [], NULL, NULL) = 1 (in [4])
read(4, "", 1024) = 0
close(4) = 0
select(4, [3], [], NULL, NULL) = 1 (in [3])
accept(3, {sa_family=AF_LOCAL, NULL}, [2]) = 4
getsockopt(4, SOL_SOCKET, SO_PEERCRED, {pid=24507, uid=1000, gid=1000}, [12]) = 0
getuid() = 1000
fcntl(4, F_GETFL) = 0x2 (flags O_RDWR)
fcntl(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0
select(5, [3 4], [], NULL, NULL) = 1 (in [4])
read(4, "\0\0\0\1\v", 1024) = 5
select(5, [3 4], [4], NULL, NULL) = 1 (out [4])
write(4, "\0\0\1<\f\0\0\0\1\0\0\1\27\0\0\0\7ssh-rsa\0\0\0\3\1\0\1\0"..., 320) =
320
select(5, [3 4], [], NULL, NULL) = 1 (in [4])
read(4, "", 1024) = 0
close(4) = 0
select(4, [3], [], NULL, NULL) = 1 (in [3])
accept(3, {sa_family=AF_LOCAL, NULL}, [2]) = 4
getsockopt(4, SOL_SOCKET, SO_PEERCRED, {pid=24900, uid=1000, gid=1000}, [12]) = 0
getuid() = 1000
fcntl(4, F_GETFL) = 0x2 (flags O_RDWR)
fcntl(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0
select(5, [3 4], [], NULL, NULL) = 1 (in [4])
read(4, "", 1024) = 0
close(4) = 0
select(4, [3], [], NULL, NULL) = ? ERESTARTNOHAND (To be restarted if
no handler)
--- SIGTERM {si_signo=SIGTERM, si_code=SI_USER, si_pid=24900, si_uid=0} ---
unlink("/tmp/ssh-vj0FsYTMJ3y0/agent.23119") = 0
rmdir("/tmp/ssh-vj0FsYTMJ3y0") = 0
close(-1) = -1 EBADF (Bad file descriptor)
exit_group(2) = ?
+++ exited with 2 +++
./execsnoop
Tracing exec()s. Ctrl-C to end.
Instrumenting sys_execve
PID PPID ARGS
24896 24894 cat -v trace_pipe
24895 24891 gawk -v o=1 -v opt_name=0 -v name= -v opt_duration=0 [...]
24897 24515 ssh playpen
24898 24897 sh [?]
24899 24898 /usr/bin/xauth list :0.0
24900 1326 /usr/sbin/sshd -D -R
24903 24902 /sbin/pam-tmpdir-helper
24904 24902 /bin/sh -c command -v debian-sa1 > /dev/null && debian-sa1 1 1
24905 24904 debian-sa1 1 1
24907 24900 /sbin/pam-tmpdir-helper
24908 1770 /usr/lib/ConsoleKit/ck-collect-session-info --uid 0 --pid 24900
24909 1770 /usr/lib/ConsoleKit/run-session.d/pam-foreground-compat.ck
24910 24900 sh [?]
24911 24910 /usr/bin/env -i
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin run-parts
--lsbsysinit /etc/update-motd.d
24912 24911 /etc/update-motd.d/00-header
24913 24912 uname -o
24914 24912 uname -r
24915 24912 uname -m
24916 24911 /etc/update-motd.d/10-help-text
24917 24916 uname -r
24918 24916 grep -qs \-server
24919 24911 /etc/update-motd.d/90-updates-available
24920 24919 apt-config shell StateDir Dir::State
24921 24920 /usr/bin/dpkg
24922 24919 apt-config shell ListDir Dir::State::Lists
24923 24922 /usr/bin/dpkg
24924 24919 apt-config shell EtcDir Dir::Etc
24925 24924 /usr/bin/dpkg
24926 24919 apt-config shell SourceList Dir::Etc::sourcelist
24927 24926 /usr/bin/dpkg
24928 24919 find /var/lib/apt//lists/ /etc/apt//sources.list -type f -newer
/var/lib/update-notifier/updates-available -print -quit [...]
24929 24919 cat /var/lib/update-notifier/updates-available
24930 24911 /etc/update-motd.d/91-release-upgrade
24932 24931 lsb_release -sd
24933 24931 cut -d -f4
24930 0 /usr/lib/ubuntu-release-upgrader/release-upgrade-motd
24934 24930 date +%s
24935 24930 stat -c %Y
/var/lib/ubuntu-release-upgrader/release-upgrade-available
24936 24930 expr 1429662656 + 86400
24937 24911 /etc/update-motd.d/98-fsck-at-reboot
24938 24937 stat -c %Y /var/lib/update-notifier/fsck-at-reboot
24940 24939 awk {print $1} /proc/uptime
24939 24937 date -d now - 709483.55 seconds +%s
24941 24937 date +%s
24943 24942 mount
24944 24942 awk $5 ~ /^ext(2|3|4)$/ { print $1 }
Looks like the culprit is sshd?
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to openssh in Ubuntu.
https://bugs.launchpad.net/bugs/1446448
Title:
ssh-agent terminates
Status in openssh package in Ubuntu:
Incomplete
Bug description:
I have set-up password less ssh connectivity for my workstation. ssh-
agent gets started via keychain when fluxbox boots.
When I use ssh to connect to a server, and then use scp to shuffle a
file from that server to my workstation the ssh-agent on my
workstation dies after the file was transferred.
This has started happening after the upgrade from 12.04 to 14.04.
I have wrapped strace into the fluxbox startup to keep an eye on ssh-
agent (I initially didn't see a pattern to the sudden death), here's
an example of the breakdown post transfer.
select(4, [3], [], NULL, NULL) = 1 (in [3])
accept(3, {sa_family=AF_LOCAL, NULL}, [2]) = 4
getsockopt(4, SOL_SOCKET, SO_PEERCRED, {pid=21130, uid=1000, gid=1000}, [12])
= 0
getuid() = 1000
fcntl(4, F_GETFL) = 0x2 (flags O_RDWR)
fcntl(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0
select(5, [3 4], [], NULL, NULL) = 1 (in [4])
read(4, "\0\0\0\1\v", 1024) = 5
select(5, [3 4], [4], NULL, NULL) = 1 (out [4])
write(4, "\0\0\1<\f\0\0\0\1\0\0\1\27\0\0\0\7ssh-rsa\0\0\0\3\1\0\1\0"..., 320)
= 320
select(5, [3 4], [], NULL, NULL) = 1 (in [4])
read(4, "", 1024) = 0
close(4) = 0
select(4, [3], [], NULL, NULL) = 1 (in [3])
accept(3, {sa_family=AF_LOCAL, NULL}, [2]) = 4
getsockopt(4, SOL_SOCKET, SO_PEERCRED, {pid=21284, uid=1000, gid=1000}, [12])
= 0
getuid() = 1000
fcntl(4, F_GETFL) = 0x2 (flags O_RDWR)
fcntl(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0
select(5, [3 4], [], NULL, NULL) = 1 (in [4])
read(4, "", 1024) = 0
close(4) = 0
select(4, [3], [], NULL, NULL) = ? ERESTARTNOHAND (To be restarted
if no handler)
--- SIGTERM {si_signo=SIGTERM, si_code=SI_USER, si_pid=21284, si_uid=0} ---
unlink("/tmp/ssh-DEwJJTGLUETC/agent.19556") = 0
rmdir("/tmp/ssh-DEwJJTGLUETC") = 0
close(-1) = -1 EBADF (Bad file descriptor)
exit_group(2) = ?
+++ exited with 2 +++
1) lsb_release -rd
Description: Ubuntu 14.04.2 LTS
Release: 14.04
2) apt-cache policy openssh-client
openssh-client:
Installed: 1:6.6p1-2ubuntu2
Candidate: 1:6.6p1-2ubuntu2
Version table:
*** 1:6.6p1-2ubuntu2 0
500 http://nz.archive.ubuntu.com/ubuntu/ trusty-updates/main amd64
Packages
100 /var/lib/dpkg/status
1:6.6p1-2ubuntu1 0
500 http://nz.archive.ubuntu.com/ubuntu/ trusty/main amd64 Packages
3) I expect ssh-agent to carry on running as it did in previous
releases.
4) It dies when connecting back from a machine I ssh into to my
workstation.
ProblemType: Bug
DistroRelease: Ubuntu 14.04
Package: openssh-client 1:6.6p1-2ubuntu2
ProcVersionSignature: Ubuntu 3.13.0-49.81-generic 3.13.11-ckt17
Uname: Linux 3.13.0-49-generic x86_64
NonfreeKernelModules: wl
ApportVersion: 2.14.1-0ubuntu3.10
Architecture: amd64
Date: Tue Apr 21 15:28:02 2015
InstallationDate: Installed on 2015-02-03 (77 days ago)
InstallationMedia: Ubuntu 14.04 LTS "Trusty Tahr" - Release amd64 (20140417)
RelatedPackageVersions:
ssh-askpass N/A
libpam-ssh 2.0-1
keychain 2.7.1-1
ssh-askpass-gnome 1:6.6p1-2ubuntu2
SSHClientVersion: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2, OpenSSL 1.0.1f 6 Jan 2014
SourcePackage: openssh
UpgradeStatus: No upgrade log present (probably fresh install)
upstart.ssh-agent.log: ssh-agent stop/pre-start, process 1973
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1446448/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
