[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#705126: kfreebsd-9: maxproc limit exceeded, caused by sshd

Source: kfreebsd-9
Version: 9.0-10
Severity: important
User: debian-bsd@lists.debian.org
Usertags: kfreebsd


After a burst of sshd bruteforce login attempts, kfreebsd's maxproc is
exhausted and now I'm unable to log in!  I only know the reason because
the machine had remote syslog set up:

> Apr  8 06:27:52 sshd[35369]: Received disconnect from 11: Bye Bye [preauth]
> Apr  8 06:27:53 sshd[35371]: Received disconnect from 11: Bye Bye [preauth]
> Apr  8 06:27:53 sshd[35373]: Received disconnect from 11: Bye Bye [preauth]
> Apr  8 06:27:53 kernel: maxproc limit exceeded by uid 0, please see tuning(7) and login.conf(5).
> Apr  8 06:27:53 sshd[35375]: fatal: fork of unprivileged child failed

Other processes such as cron cannot spawn either.

The problem did not resolve itself in 36 hours.  I've had to reset the
machine now.

The setting of "MaxStartups 4:20:8" should limit to 8 sshd child
processes in the pre-authentication state;  there were no authenticated
sessions at the time.

SSH connections usually terminate right after key exchange, because only
the publickey method is allowed for this server.  Some bots are not
clever enough to understand this and keep trying.

>From past investigation of the issue, it seemed that sshd child
processes were not visible in 'ps' output or /proc/<pid> after the
client disconnected, but the maxproc limit would still be 'exceeded'.
Maybe this is an eglibc issue.

-- System Information:
Debian Release: 7.0
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: kfreebsd-amd64 (x86_64)

Kernel: kFreeBSD 9.0-2-amd64
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages kfreebsd-image-9.0-2-amd64 depends on:
ii  devd           9.0+ds1-10
ii  freebsd-utils  9.0+ds1-10
ii  kbdcontrol     9.0+ds1-10
ii  kldutils       9.0+ds1-10

kfreebsd-image-9.0-2-amd64 recommends no packages.

kfreebsd-image-9.0-2-amd64 suggests no packages.

-- no debconf information

Reply to: