Re: runit not collecting zombies

[Alex Efros <powerman@powerman.asdfGroup.com>]

Hi!

On Wed, Sep 12, 2007 at 12:02:48PM -0400, Charlie Brady wrote:
> No, I just haven't seen any evidence. I suspect you are misinterpreting the 
> misbehaviour of some program started from ssh, and attributing that 
> program's failures to ssh. ssh is always used to start other programs, and 
> other programs can always generate zombies. There's nothing ssh can do to 

I don't think it's 'other programs'. If this issue happens with
'other programs', then I'll probably see 'other programs' names in `ps`
output, while I have seen '[sshd]'. I think this is the reason for ssh zombies:

(14)   auth.err:  Sep  5 09:02:00 sshd[3133]: error: channel 0: chan_read_failed for istate 3
(29)   auth.info: Sep  5 18:13:37 sshd[1022]: Did not receive identification string from 85.17.106.138
(3789) auth.info: Sep  6 13:27:18 sshd[5016]: Invalid user apple from 81.228.45.11
(102)  auth.info: Sep  6 13:27:52 sshd[5144]: User mysql not allowed because account is locked
(576)  auth.info: Sep 11 16:24:04 sshd[1210]: Address 66.236.207.196 maps to intra-works.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
(1)    auth.info: Sep 11 16:39:13 sshd[1323]: User ldap not allowed because shell /dev/null is not executable

The number in a parens is amount of lines in my log similar to shown above.

This is usual enough nowadays. SSH worms trying to hack our systems. 
My sshd has password authentication disabled, so I'm not worry much about
these worms... but looks like they force sshd to fork and exit very
quickly because of failed auth, and so sshd start producing unreaped
zombies at some point.

-- 
			WBR, Alex.