Bug#354088: sshd: ctrl+C on ssh login creates defunct sshd processes

[Pauli Virtanen <pauli@boojum.hut.fi>]

Package: ssh
Version: 1:3.8.1p1-8.sarge.4
Severity: normal


Aborting an ssh login by Ctrl+C at the password prompt creates zombie
sshd processes. Apparently, the sshd master process never cleans these
up.

There are also automatic cron jobs that use ssh, but I am not sure
whether also these create defunct sshd processes.

Otherwise, sshd functions just as expected, but thousands of defunct
processes tend to slow down 'top'.


-- A deterministic way to reproduce:
pauli@xxx$ ps aux|grep 'sshd. <defunct>'|wc -l
16650
pauli@xxx$ ssh pauli@xxx
Password: <Ctrl+C>

pauli@xxx$ ps aux|grep 'sshd. <defunct>'|wc -l
16651


-- Snapshot from 'ps fawux':
root      3312  0.0  0.0  3476  368 ?        Ss    2005   0:16 /usr/sbin/sshd
root     29092  0.0  0.0     0    0 ?        Zs    2005   0:00  \_ [sshd] <defunct>
root     20923  0.0  0.0     0    0 ?        Zs   Jan16   0:00  \_ [sshd] <defunct>
... 16651 of them


-- /etc/ssh/sshd_config:
Port 22
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
UsePrivilegeSeparation yes
KeyRegenerationInterval 3600
ServerKeyBits 768
SyslogFacility AUTH
LogLevel INFO
LoginGraceTime 600
PermitRootLogin no
StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
IgnoreRhosts yes
RhostsRSAAuthentication no
HostbasedAuthentication no
PermitEmptyPasswords no
PasswordAuthentication yes
X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
KeepAlive yes
Subsystem       sftp    /usr/lib/sftp-server
UsePAM yes


-- System Information:
Debian Release: 3.1
Architecture: i386 (x86_64)
Kernel: Linux 2.6.8-9-em64t-p4-smp
Locale: LANG=en_US, LC_CTYPE=en_US (charmap=ISO-8859-1)

Versions of packages ssh depends on:
ii  adduser                3.63              Add and remove users and groups
ii  debconf                1.4.30.13         Debian configuration management sy
ii  dpkg                   1.10.28           Package maintenance system for Deb
ii  libc6                  2.3.2.ds1-22      GNU C Library: Shared libraries an
ii  libpam-modules         0.76-22           Pluggable Authentication Modules f
ii  libpam-runtime         0.76-22           Runtime support for the PAM librar
ii  libpam0g               0.76-22           Pluggable Authentication Modules l
ii  libssl0.9.7            0.9.7e-3sarge1    SSL shared libraries
ii  libwrap0               7.6.dbs-8         Wietse Venema's TCP wrappers libra
ii  zlib1g                 1:1.2.2-4.sarge.2 compression library - runtime

-- debconf information:
  ssh/insecure_rshd:
  ssh/user_environment_tell:
* ssh/forward_warning:
  ssh/insecure_telnetd:
  ssh/new_config: true
* ssh/use_old_init_script: true
* ssh/SUID_client: true
  ssh/disable_cr_auth: false
  ssh/ssh2_keys_merged:
* ssh/protocol2_only: true
  ssh/encrypted_host_key_but_no_keygen:
* ssh/run_sshd: true