Re: runit not collecting zombies

[Charlie Brady <charlieb-supervision@budge.apana.org.au>]

On Wed, 12 Sep 2007, Alex Efros wrote:

> On Wed, Sep 12, 2007 at 12:02:48PM -0400, Charlie Brady wrote:
>> No, I just haven't seen any evidence. I suspect you are misinterpreting the
>> misbehaviour of some program started from ssh, and attributing that
>> program's failures to ssh. ssh is always used to start other programs, and
>> other programs can always generate zombies. There's nothing ssh can do to
>
> I don't think it's 'other programs'. If this issue happens with
> 'other programs', then I'll probably see 'other programs' names in `ps`
> output, while I have seen '[sshd]'.

Indeed. Please remember that we haven't seen your ps output.

> I think this is the reason for ssh zombies:
>
> (14)   auth.err:  Sep  5 09:02:00 sshd[3133]: error: channel 0: chan_read_failed for istate 3
> (29)   auth.info: Sep  5 18:13:37 sshd[1022]: Did not receive identification string from 85.17.106.138
> (3789) auth.info: Sep  6 13:27:18 sshd[5016]: Invalid user apple from 81.228.45.11
> (102)  auth.info: Sep  6 13:27:52 sshd[5144]: User mysql not allowed because account is locked
> (576)  auth.info: Sep 11 16:24:04 sshd[1210]: Address 66.236.207.196 maps to intra-works.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
> (1)    auth.info: Sep 11 16:39:13 sshd[1323]: User ldap not allowed because shell /dev/null is not executable
>
> The number in a parens is amount of lines in my log similar to shown above.

Well they're not reason for ssh zombies. They're just sshd log messages, 
which won't cause zombies. Zombies are caused by programming errors.

> This is usual enough nowadays. SSH worms trying to hack our systems.

Yep, everyone sees them. Not everyone sees sshd zombies.

> My sshd has password authentication disabled, so I'm not worry much about
> these worms... but looks like they force sshd to fork and exit very
> quickly because of failed auth, and so sshd start producing unreaped
> zombies at some point.

If the parent sshd continues to run, then it can fork lots of children, 
all or many of which exit very quickly, and there will still be no zombies 
reparented to init. There's something more going on here. You would be 
well advised to report the problem to whoever maintains the ssh which you 
use and/or the ssh maintainers.