Tasmanian Devil wrote:
> The permissions of /dev/null change directly after (or maybe even
> while) using SFTP, and not always.

It's not just permissions, it's no longer a character special (device)
file, it's a regular file.  This usually happens when /dev/null is
deleted, and sooner or later something with root perms will write to it,
at which point it gets recreated as a regular file.

Yes, that might be it.

> Sometimes I can log in several
> times over a few hours without fixing /dev/null, and then again only
> one single time. E.g. right now I can't reproduce the error. And if I
> don't use SCP/SFTP at all, everything works fine, for weeks, so it
> seems to be related to SCP/SFTP.

During that time, is /dev/null still a character special, or has it
turned into a regular file?

I'm quite sure it's still a character special during that time (or at
least most of that time). Every time I checked it was one, though I
never checked directly before using SCP or SFTP, especially not after
I was hoping that last snapshot installation had fixed it.

I suspect that something else (maybe a cron job?) is removing /dev/null
and the scp/sftp error is just a symptom.

Yes, that's possible, though on that server are only the original
cronjobs which came with the default install. I didn't add any
additional cronjob.

You could try something like this running from cron regularly:

test -c /dev/null || echo /dev/null vanished or not character special

and see if/when it starts mailing you.

Good idea, I'll try that, but maybe it's even not necessary? I have
the timestamp on the regular file which was created somehow (from my
first post):

/dev root# ls -l null
-rw-------  1 root  wheel  56 Mar 27 18:13 null

So I checked /var/log for this timestamp (I hope I catched all entries
this way, I'm not an professional like many of you are, though I learn
more and more about OpenBSD and it's a lot of fun for me :-) ):

# zgrep 'Mar 27 18:1' /var/log/*
/var/log/daemon:Mar 27 18:13:12 tas identd[20077]: Connection from localhost /var/log/daemon:Mar 27 18:13:12 tas identd[13260]: Connection from localhost /var/log/daemon:Mar 27 18:13:12 tas identd[24972]: Connection from localhost
/var/log/daemon:Mar 27 18:13:17 tas identd[20077]: scanf:
invalid-port(s): 0 , 0 from localhost
/var/log/maillog.0.gz:Mar 27 18:13:12 tas sm-mta[22178]:
l2RGDCfv022178: [EMAIL PROTECTED] [127.0.0.1] did not issue
MAIL/EXPN/VRFY/ETRN during connection to MTA
/var/log/maillog.0.gz:Mar 27 18:13:12 tas sm-mta[1887]:
l2RGDCxT001887: [EMAIL PROTECTED] [127.0.0.1] did not issue
MAIL/EXPN/VRFY/ETRN during connection to MSA
/var/log/messages.0.gz:Mar 27 18:13:17 tas identd[20077]: scanf:
invalid-port(s): 0 , 0 from localhost

Does that help somehow?

Tas.
Do a "cat /dev/null" when it is a regular file (as root, we can see the permissions are tight).. The contents of the file may give a clue as to the last process that (successfully) wrote to /dev/null.

Just my $.02 worth.

Good luck!

Cheers,
Steve Williams

Reply via email to