Bug#705126: kfreebsd-9: maxproc limit exceeded, caused by sshd
Source: kfreebsd-9
Version: 9.0-10
Severity: important
User: debian-bsd@lists.debian.org
Usertags: kfreebsd
Hi,
After a burst of sshd bruteforce login attempts, kfreebsd's maxproc is
exhausted and now I'm unable to log in! I only know the reason because
the machine had remote syslog set up:
> Apr 8 06:27:52 sshd[35369]: Received disconnect from 176.31.17.65: 11: Bye Bye [preauth]
> Apr 8 06:27:53 sshd[35371]: Received disconnect from 176.31.17.65: 11: Bye Bye [preauth]
> Apr 8 06:27:53 sshd[35373]: Received disconnect from 176.31.17.65: 11: Bye Bye [preauth]
> Apr 8 06:27:53 kernel: maxproc limit exceeded by uid 0, please see tuning(7) and login.conf(5).
> Apr 8 06:27:53 sshd[35375]: fatal: fork of unprivileged child failed
Other processes such as cron cannot spawn either.
The problem did not resolve itself in 36 hours. I've had to reset the
machine now.
The setting of "MaxStartups 4:20:8" should limit to 8 sshd child
processes in the pre-authentication state; there were no authenticated
sessions at the time.
SSH connections usually terminate right after key exchange, because only
the publickey method is allowed for this server. Some bots are not
clever enough to understand this and keep trying.
>From past investigation of the issue, it seemed that sshd child
processes were not visible in 'ps' output or /proc/<pid> after the
client disconnected, but the maxproc limit would still be 'exceeded'.
Maybe this is an eglibc issue.
-- System Information:
Debian Release: 7.0
APT prefers testing
APT policy: (500, 'testing')
Architecture: kfreebsd-amd64 (x86_64)
Kernel: kFreeBSD 9.0-2-amd64
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages kfreebsd-image-9.0-2-amd64 depends on:
ii devd 9.0+ds1-10
ii freebsd-utils 9.0+ds1-10
ii kbdcontrol 9.0+ds1-10
ii kldutils 9.0+ds1-10
kfreebsd-image-9.0-2-amd64 recommends no packages.
kfreebsd-image-9.0-2-amd64 suggests no packages.
-- no debconf information
Reply to: