Re: Stuck CLOSED sockets / sshd / zombies...

On Monday, April 07, 2014 7:12:03 am Karl Pielorz wrote:
> 
> --On 04 April 2014 16:13 -0400 John Baldwin <jhb@freebsd.org> wrote:
> 
> > Ugh, ok.  Is this easy to reproduce?
> 
> Ok, yes - I can reproduce this now. I scanned the new host I setup with our 
> security scanning software.
> 
> This generated a number of sshd caught in 'urdlck' - and a large number of 
> sockets that end up as 'CLOSE_WAIT' I'm guessing given time these will 
> finally move to 'CLOSED' (it was scanned hours ago and there's still 50+ in 
> CLOSE_WAIT state).
> 
> As I said originally this can't be the only cause - but it is a cause.
> 
> So now I can reproduce it - what next?

Ok, do you have a matching /usr/src on the boxes in question?  If so, please 
do this:

cd /usr/src/lib/libc
make DEBUG_FLAGS=-g all install
cd /usr/src/lib/libthr
make DEBUG_FLAGS=-g all install
cd /usr/src/secure/lib/libssh
make DEBUG_FLAGS=-g all install
cd /usr/src/secure/usr.sbin/sshd
make DEBUG_FLAGS=-g all install

sh /etc/rc.d/sshd restart

Then re-run the scan to get a stuck sshd.  Once that happens, please
attach to the top-most stock sshd (the one in "urdlck") with gdb
(gdb /usr/sbin/sshd <pid>) and run 'bt' and reply with the output.

-- 
John Baldwin
_______________________________________________
freebsd-hackers@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"