I have a server running centOS 5; GLAMP. This is a local only setup--no outside access.
netstat reveals an ESTABLISHED ssh connection from a machine on the LAN. This machine is running XP, and has nothing on it that utilizes SSH:
# netstat | grep tcp tcp 0 0 dev.test.local:ssh ::ffff:192.168.1.11:51486 ESTABLISHED
Things I've tried:
- added a rule to iptables to deny all from this machine
- restarted networking, apache, sshd, and the whole machine eventually
- temporarily changed IP of offending machine (can't permanently; people need it)
An interesting note: while I was investigating hping to try and nuke the connection, I noticed that the machine would not respond to hping - 100% packet loss. However, normal ping works as expected. As such, hping -F host does not work because for some reason, hping does not reach the host.
This is all in an effort to try and decipher why all of a sudden apache seems so slow. There was a network change recently, but nothing that should have affected this part of the LAN. I don't know that this is part of the issue, but is a variable I need to eliminate.
Any ideas on how I can kill this connection?
OK, it turns out I can't kill it, because it is my shell! However, it is not reflecting my proper IP address for some reason. When I fist connect, though, it says my last login was from the correct IP address, but netstat reveals the incorrect address:
Last login: Thu Oct 27 10:42:25 2011 from 192.168.1.17 # netstat | grep tcp tcp 0 0 dev.test.local:ssh ::ffff:192.168.1.11:53461 ESTABLISHED
Here is tail of /var/log/secure
Oct 27 10:42:25 dev sshd: Accepted password for root from 192.168.1.17 port 53428 ssh2 Oct 27 10:42:25 dev sshd: pam_unix(sshd:session): session opened for user root by (uid=0) Oct 27 10:45:08 dev sshd: Received disconnect from 192.168.1.17: 11: disconnected by user Oct 27 10:45:08 dev sshd: pam_unix(sshd:session): session closed for user root Oct 27 10:45:24 dev sshd: Accepted password for root from 192.168.1.17 port 53461 ssh2 Oct 27 10:45:24 dev sshd: pam_unix(sshd:session): session opened for user root by (uid=0)