0

UPDATE (7th Dec 2010) & WARNING: I copied the files discussed below (from the /var/tmp/vi.recover directory) to my Windows PC and sacnned with ESET NOD 32. It identifed two of the file (sshd: and juno) as the Linux/RST.B virus. Not sure if it is accurate in saying that but since the machine is a development server I'm going to re-build to be safe.

Hello,

I am using a Red Hat server and am getting the following errors every minute in the messages file:

Dec  1 16:50:01 ocalhost kernel: sshd:[4981]: segfault at 0000000000000079 rip 000000000807100f rsp 00000000ffb901ec error 6
Dec  1 16:51:01 ocalhost kernel: sshd:[4990]: segfault at 0000000000000079 rip 000000000807100f rsp 00000000ffce4b3c error 6
Dec  1 16:52:01 ocalhost kernel: sshd:[5000]: segfault at 0000000000000079 rip 000000000807100f rsp 00000000ffb7f9dc error 6
Dec  1 16:53:01 ocalhost kernel: sshd:[5010]: segfault at 0000000000000079 rip 000000000807100f rsp 00000000fff08d5c error 6
Dec  1 16:54:01 ocalhost kernel: sshd:[5022]: segfault at 0000000000000079 rip 000000000807100f rsp 00000000ffaf194c error 6

I've had a look in the SSH log file and it doesn't show any errors (not even those above). Can anyone tell me what an 'error 6' is or shed any light on why this may be happening. If anyone can suggest anywhere else I can look for more clues that would be great, I seem to have reached a dead end on this one.

Further to the comments below, here is the start function from the /etc/init.d/sshd file:

start()
{
        # Create keys if necessary
        if [ "x${AUTOCREATE_SERVER_KEYS}" != xNO ]; then
                do_rsa1_keygen
                do_rsa_keygen
                do_dsa_keygen
        fi

        cp -af /etc/localtime /var/empty/sshd/etc

        echo -n $"Starting $prog: "
        $SSHD $OPTIONS && success || failure
        RETVAL=$?
        [ "$RETVAL" = 0 ] && touch /var/lock/subsys/sshd
        echo
}

Thanks C

1 Answer 1

0

Can you tell me if hpsmh is installed and running?

rpm -q hpsmh; [ -f "/opt/hp/hpsmh/logs/httpd.pid" ] && echo "running" || echo "not running"

Also, if hpsmh is installed, what are the permissions on its install root?

27
  • Thanks. hpsmh is not running. I've done a whereis and can't find hpsmh.
    – columbo
    Dec 1, 2010 at 17:29
  • @columbo - can you please execute a `find / -type f -name 'libssl.so.*'?
    – Tok
    Dec 1, 2010 at 17:36
  • Thanks for your reply....the result of the find is /lib/libssl.so.0.9.8b & /lib64/libssl.so.0.9.8b
    – columbo
    Dec 2, 2010 at 9:02
  • Some more info... I installed atop and from atop's data I can see that the number of sshd processes running is increasing by 1 a minute. So, it would seem, each of these errors is causing a new sshd instance to start. This in turn is gradually sapping the RAM until it crashes the server.
    – columbo
    Dec 2, 2010 at 9:52
  • Found this occuring every minute in the cron log /var/tmp/vi.recover/update >/dev/null 2>&1. Happens at 1 second past every minute the same as the SSHD errors...
    – columbo
    Dec 2, 2010 at 11:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .