Re: runit-1.8.0 available

[George Georgalis <george@galis.org>]

On Sat, Oct 20, 2007 at 10:59:50PM +0300, Alex Efros wrote:
>Hi!
>
>On Mon, Oct 15, 2007 at 11:38:18PM -0400, George Georgalis wrote:
>> This thread(s) is so long it's become difficult to follow. Maybe
>> you could consolidate the important details into a summary. What
>> is the simplest way to reproduce the problem. What has been tried?
>> What factors are determined not related. What hypothesis, if any,
>> for resolution?
>
>Only known to me way to reproduce the problem - install new Gentoo server
>and wait for about a week to see sshd zombies (as result of ssh-worms
>trying to bruteforce ssh from time to time).
>
>Tried? I tried to switch from runit-init to sysvinit, and this solved issue.
>Also Gerrit suggested a workaround: running 'chmod -x /etc/runit/stopit;
>kill -CONT 1' on system with unreaped zombies result in two things: first
>all zombies are reaped, and second runit start reaping zombies again...
>but after several days it stop reaping zombies again and we need to
>chmod/kill again.
>
>Not related... there several factors determined not related (like
>grsecurity kernel patches), but that was while I wasn't sure this is bug
>in runit.
>
>Mostly strange thing is this happens as least for two people, at same time
>after Gentoo upgrade. And that upgrade doesn't touch runit or toolchain -
>nothing in this upgrade seems suspicious.
>
>Only hypothesis I've - this issue related to date/time: it usually happens
>at same time on all my servers (and looks like this related to global
>date/time, and not to server uptime), and it usually repeats every 5-7 days.
>
>I think easies way to solve this issue - if Gerrit provide test/debug
>version of runit to me, which for example output it state/actions into log
>file, and then he'll analyse that log file to find out what is going wrong.
>Because looks like he unable to find this bug by just looking at the code.

it sounds like a signal is not reaching init, SIGPIPE?

The following sed to default sshd_config
	s/.*PasswordAuthentication.*/PasswordAuthentication no/
	s/.*UsePam.*/UsePam no/
will really cut back the impact of bad internet on public sshd port,
of course you will only be able to use keys (PKI/RSA) to connect.

// George

-- 
George Georgalis, information system scientist <IXOYE><