[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#705126: marked as done (kfreebsd-9: maxproc limit exceeded, caused by sshd)

Your message dated Fri, 28 Jul 2023 16:47:41 +0000
with message-id <[🔎] E1qPQcv-00EwDn-Ap@fasolo.debian.org>
and subject line Bug#1041056: Removed package(s) from unstable
has caused the Debian Bug report #705126,
regarding kfreebsd-9: maxproc limit exceeded, caused by sshd
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
705126: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=705126
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Source: kfreebsd-9
Version: 9.0-10
Severity: important
User: debian-bsd@lists.debian.org
Usertags: kfreebsd

Hi,

After a burst of sshd bruteforce login attempts, kfreebsd's maxproc is
exhausted and now I'm unable to log in!  I only know the reason because
the machine had remote syslog set up:

> Apr  8 06:27:52 sshd[35369]: Received disconnect from 176.31.17.65: 11: Bye Bye [preauth]
> Apr  8 06:27:53 sshd[35371]: Received disconnect from 176.31.17.65: 11: Bye Bye [preauth]
> Apr  8 06:27:53 sshd[35373]: Received disconnect from 176.31.17.65: 11: Bye Bye [preauth]
> Apr  8 06:27:53 kernel: maxproc limit exceeded by uid 0, please see tuning(7) and login.conf(5).
> Apr  8 06:27:53 sshd[35375]: fatal: fork of unprivileged child failed

Other processes such as cron cannot spawn either.

The problem did not resolve itself in 36 hours.  I've had to reset the
machine now.

The setting of "MaxStartups 4:20:8" should limit to 8 sshd child
processes in the pre-authentication state;  there were no authenticated
sessions at the time.

SSH connections usually terminate right after key exchange, because only
the publickey method is allowed for this server.  Some bots are not
clever enough to understand this and keep trying.

>From past investigation of the issue, it seemed that sshd child
processes were not visible in 'ps' output or /proc/<pid> after the
client disconnected, but the maxproc limit would still be 'exceeded'.
Maybe this is an eglibc issue.

-- System Information:
Debian Release: 7.0
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: kfreebsd-amd64 (x86_64)

Kernel: kFreeBSD 9.0-2-amd64
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages kfreebsd-image-9.0-2-amd64 depends on:
ii  devd           9.0+ds1-10
ii  freebsd-utils  9.0+ds1-10
ii  kbdcontrol     9.0+ds1-10
ii  kldutils       9.0+ds1-10

kfreebsd-image-9.0-2-amd64 recommends no packages.

kfreebsd-image-9.0-2-amd64 suggests no packages.

-- no debconf information

--- End Message ---
--- Begin Message --- 
Version: 10.3~svn300087+ds1-1+rm

Dear submitter,

as the package kfreebsd-10 has just been removed from the Debian archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/1041056

The version of this package that was in Debian prior to this removal
can still be found using https://snapshot.debian.org/.

Please note that the changes have been done on the master archive and
will not propagate to any mirrors until the next dinstall run at the
earliest.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmaster@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Scott Kitterman (the ftpmaster behind the curtain)

--- End Message ---
Reply to: