2

my linux box just got this error messages every minutes in /var/log/secure

Jun 14 04:24:28 mybox sshd[19741]: Connection closed by 127.0.0.1
Jun 14 04:25:28 mybox sshd[19764]: Connection closed by 127.0.0.1
Jun 14 04:26:28 mybox sshd[19770]: Connection closed by 127.0.0.1
Jun 14 04:27:28 mybox sshd[19776]: Connection closed by 127.0.0.1
Jun 14 04:28:28 mybox sshd[19782]: Connection closed by 127.0.0.1
Jun 14 04:29:28 mybox sshd[19789]: Connection closed by 127.0.0.1

it was centos 5.2 x86_64 with OpenSSH_4.3p2, the sshd port is not set as default, i'd used different port, i tought it was some bad programm did some brute force ssh attck from inside (lo). i had try to put sshd: 127.0.0.1 in /etc/hosts.deny, and then the messages changed now,

Jun 14 12:45:54 mybox sshd[25736]: refused connect from ::ffff:127.0.0.1 (::ffff:127.0.0.1)
Jun 14 12:45:59 mybox sshd[25701]: Received signal 15; terminating.
Jun 14 12:46:00 mybox sshd[25761]: Server listening on :: port 5522.
Jun 14 12:46:00 mybox sshd[25761]: error: Bind to port 5522 on 0.0.0.0 failed: Address already in use.
Jun 14 12:47:01 mybox sshd[25767]: refused connect from ::ffff:127.0.0.1 (::ffff:127.0.0.1)
Jun 14 12:47:06 mybox sshd[25761]: Received signal 15; terminating.
Jun 14 12:47:07 mybox sshd[25792]: Server listening on :: port 5522.
Jun 14 12:47:07 mybox sshd[25792]: error: Bind to port 5522 on 0.0.0.0 failed: Address already in use.
Jun 14 12:54:19 mybox sshd[25881]: error: Bind to port 5522 on 0.0.0.0 failed: Address already in use.
Jun 14 12:54:19 mybox sshd[25881]: fatal: Cannot bind any address.

does anyone got this issue before ? how can i analyze this things..

racbear
  • 99
  • 2
  • 7

4 Answers4

4

Do you have some kind of system monitoring tool (monit/collectd) that could be checking to see if your ssh server is alive and accepting connections?

Joe
  • 1,545
  • 1
  • 10
  • 15
1
Jun 14 12:46:00 mybox sshd[25761]: Server listening on :: port 5522.
Jun 14 12:46:00 mybox sshd[25761]: error: Bind to port 5522 on 0.0.0.0 failed: Address already in use.

I think whatever script is starting your sshd is failing to detect that the process it running and restarting it repeatedly.

Dave Cheney
  • 18,567
  • 8
  • 49
  • 56
0

The key here is "address already in use". Another process has already bound to that port. Are you attempting to run two instances of the service? Occasionally, the control scripts will loose their mind (not really, what happens is that the pid file gets removed but not the process) and they will attempt to launch the service when it's already running. First, stop the service once and see if the message appears.

service sshd stop

Then do a check to see if there is already a sshd lying around...

ps ax | grep "ssh" | grep -v "grep"

If you see one after the service is stopped, that's the cause of the issue. Kill it, then start the service up again

service sshd start

P.S. Yes, I know my shell scripting sucks, but sometimes clarity is quicker than brevity.

Avery Payne
  • 14,536
  • 1
  • 51
  • 88
  • "address already in use" , i dont think this is the key .. this messages only appear when i put to deny 127.0.0.1:sshd into /etc/hosts.deny . it seems to difficult to analyze with stopping sshd service, because i work remotely :) – racbear Jun 14 '09 at 10:11
  • 1
    "address already in use" means exactly what it says on the tin. sshd is trying to start up and use port 5522, but something else is already using that port, and that is most likely to be itself. You can use "netstat -lep --tcp" to find out what process that is. Oh, Avery, pgrep :P – David Pashley Jun 14 '09 at 10:48
  • @Andri - anytime you run into "address already in use" it is 99% of the time what it says - something is already at that port, so the system refuses to attach anything else to that port. As far as remotely working, as long as you don't kill your own session, you're fine, you can restart sshd without distrupting the session you're in, just don't kill it! – Avery Payne Jun 14 '09 at 12:41
0

The connections are obviously coming from the local machine (127.0.0.1) - so you don't have to look very far.

And the log messages are being generated by sshd (so sshd is detecting the attempted connections) - so you know that whatever process is causing these, either it knows about the non-standard port, or you have a second instance of sshd running on the standard port (use netstat to check).

Can you temporarily remove the hosts.deny entry,and then use lsof to determine which process is attempting to access your non-standard sshd port (lsof -i :port)?

If nothing shows up, I would use chkrootkit or rkhunter to ensure your system has not been compromised.

Brent
  • 22,857
  • 19
  • 70
  • 102