Source: kfreebsd-9 Version: 9.0-10 Severity: important User: debian-bsd@lists.debian.org Usertags: kfreebsd
Hi, After a burst of sshd bruteforce login attempts, kfreebsd's maxproc is exhausted and now I'm unable to log in! I only know the reason because the machine had remote syslog set up: > Apr 8 06:27:52 sshd[35369]: Received disconnect from 176.31.17.65: 11: Bye > Bye [preauth] > Apr 8 06:27:53 sshd[35371]: Received disconnect from 176.31.17.65: 11: Bye > Bye [preauth] > Apr 8 06:27:53 sshd[35373]: Received disconnect from 176.31.17.65: 11: Bye > Bye [preauth] > Apr 8 06:27:53 kernel: maxproc limit exceeded by uid 0, please see tuning(7) > and login.conf(5). > Apr 8 06:27:53 sshd[35375]: fatal: fork of unprivileged child failed Other processes such as cron cannot spawn either. The problem did not resolve itself in 36 hours. I've had to reset the machine now. The setting of "MaxStartups 4:20:8" should limit to 8 sshd child processes in the pre-authentication state; there were no authenticated sessions at the time. SSH connections usually terminate right after key exchange, because only the publickey method is allowed for this server. Some bots are not clever enough to understand this and keep trying. >From past investigation of the issue, it seemed that sshd child processes were not visible in 'ps' output or /proc/<pid> after the client disconnected, but the maxproc limit would still be 'exceeded'. Maybe this is an eglibc issue. -- System Information: Debian Release: 7.0 APT prefers testing APT policy: (500, 'testing') Architecture: kfreebsd-amd64 (x86_64) Kernel: kFreeBSD 9.0-2-amd64 Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages kfreebsd-image-9.0-2-amd64 depends on: ii devd 9.0+ds1-10 ii freebsd-utils 9.0+ds1-10 ii kbdcontrol 9.0+ds1-10 ii kldutils 9.0+ds1-10 kfreebsd-image-9.0-2-amd64 recommends no packages. kfreebsd-image-9.0-2-amd64 suggests no packages. -- no debconf information -- To UNSUBSCRIBE, email to debian-bsd-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/51655acd.4080...@pyro.eu.org
