O servidor ficou repentinamente indiferente ao SSH

5

O servidor repentinamente parou de responder ao SSH, eu relatei a última vez que aconteceu aqui em outro servidor que eu tenho cerca de 2 meses atrás. A configuração do servidor é de 64 bits do CentOS6, ele executa um servidor apache2 muito básico que oferece arquivos estáticos e deve estar sob cargas muito pequenas, já que ele está por trás de um Amazon CloudFront em cache.

Foi-me dito para procurar por /var/log/messages , mas quando eu abri-lo pelo tempo do problema (por volta das 18:00 de 27/02/2012) há muitas mensagens lá que eu não tenho idéia do que elas significam, e pesquisando não está ajudando muito, então eu estava me perguntando se alguém mais experiente poderia dar uma olhada neste log e me dizer se eles vêem algo estranho.

Feb 26 03:06:02 173 kernel: imklog 4.6.2, log source = /proc/kmsg started.
Feb 26 03:06:02 173 rsyslogd: [origin software="rsyslogd" swVersion="4.6.2" x-pid="1439" x-info="http://www.rsyslog.com"] (re)start
Feb 26 04:20:01 173 auditd[1414]: Audit daemon rotating log files
Feb 26 13:37:09 173 auditd[1414]: Audit daemon rotating log files
Feb 27 08:03:03 173 auditd[1414]: Audit daemon rotating log files
Feb 27 18:35:13 173 init: tty (/dev/tty2) main process (1958) killed by TERM signal
Feb 27 18:35:13 173 init: tty (/dev/tty3) main process (1960) killed by TERM signal
Feb 27 18:35:13 173 init: tty (/dev/tty4) main process (1962) killed by TERM signal
Feb 27 18:35:13 173 init: tty (/dev/tty5) main process (1964) killed by TERM signal
Feb 27 18:35:13 173 init: tty (/dev/tty6) main process (1966) killed by TERM signal
Feb 27 18:35:15 173 qpidd[1893]: 2012-02-27 18:35:15 notice Shut down
Feb 27 18:35:16 173 abrtd: Got signal 15, exiting
Feb 27 18:35:20 173 acpid: exiting
Feb 27 18:35:20 173 init: Disconnected from system bus
Feb 27 18:35:20 173 rpcbind: rpcbind terminating on signal. Restart with "rpcbind -w"
Feb 27 18:35:20 173 console-kit-daemon[1982]: WARNING: no sender#012
Feb 27 18:35:20 173 auditd[1414]: The audit daemon is exiting.
Feb 27 18:35:20 173 kernel: type=1305 audit(1330389320.836:995029): audit_pid=0 old=1414 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
Feb 27 18:35:20 173 kernel: type=1305 audit(1330389320.936:995030): audit_enabled=0 old=1 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
Feb 27 18:35:20 173 kernel: Kernel logging (proc) stopped.
Feb 27 18:35:20 173 rsyslogd: [origin software="rsyslogd" swVersion="4.6.2" x-pid="1439" x-info="http://www.rsyslog.com"] exiting on signal 15.
Feb 27 18:38:07 173 kernel: imklog 4.6.2, log source = /proc/kmsg started.
Feb 27 18:38:07 173 rsyslogd: [origin software="rsyslogd" swVersion="4.6.2" x-pid="1437" x-info="http://www.rsyslog.com"] (re)start
Feb 27 18:38:07 173 kernel: Initializing cgroup subsys cpuset
Feb 27 18:38:07 173 kernel: Initializing cgroup subsys cpu
Feb 27 18:38:07 173 kernel: Linux version 2.6.32-220.2.1.el6.x86_64 ([email protected]) (gcc version 4.4.6 20110731 (Red Hat 4.4.6-3) (GCC) ) #1 SMP Fri Dec 23 02:21:33 CST 2011
Feb 27 18:38:07 173 kernel: Command line: ro root=/dev/mapper/vg_173-lv_root rd_LVM_LV=vg_173/lv_swap rd_NO_LUKS LANG=en_US.UTF-8 rd_LVM_LV=vg_173/lv_root rd_NO_MD quiet SYSFONT=latarcyrheb-sun16 rhgb crashkernel=auto  KEYBOARDTYPE=pc KEYTABLE=us rd_NO_DM
Feb 27 18:38:07 173 kernel: KERNEL supported cpus:
Feb 27 18:38:07 173 kernel:  Intel GenuineIntel
Feb 27 18:38:07 173 kernel:  AMD AuthenticAMD
Feb 27 18:38:07 173 kernel:  Centaur CentaurHauls
Feb 27 18:38:07 173 kernel: BIOS-provided physical RAM map:
Feb 27 18:38:07 173 kernel: BIOS-e820: 0000000000000000 - 000000000009b800 (usable)
Feb 27 18:38:07 173 kernel: BIOS-e820: 000000000009b800 - 00000000000a0000 (reserved)
Feb 27 18:38:07 173 kernel: BIOS-e820: 00000000000e0000 - 0000000000100000 (reserved)
Feb 27 18:38:07 173 kernel: BIOS-e820: 0000000000100000 - 00000000be7a8000 (usable)
Feb 27 18:38:07 173 kernel: BIOS-e820: 00000000be7a8000 - 00000000be7f4000 (ACPI NVS)
Feb 27 18:38:07 173 kernel: BIOS-e820: 00000000be7f4000 - 00000000be7fc000 (ACPI data)
Feb 27 18:38:07 173 kernel: BIOS-e820: 00000000be7fc000 - 00000000bf47a000 (reserved)
Feb 27 18:38:07 173 kernel: BIOS-e820: 00000000bf47a000 - 00000000bf47b000 (ACPI NVS)
Feb 27 18:38:07 173 kernel: BIOS-e820: 00000000bf47b000 - 00000000bf48c000 (reserved)
Feb 27 18:38:07 173 kernel: BIOS-e820: 00000000bf48c000 - 00000000bf48f000 (ACPI NVS)
Feb 27 18:38:07 173 kernel: BIOS-e820: 00000000bf48f000 - 00000000bf4b0000 (reserved)
Feb 27 18:38:07 173 kernel: BIOS-e820: 00000000bf4b0000 - 00000000bf4b2000 (usable)
Feb 27 18:38:07 173 kernel: BIOS-e820: 00000000bf4b2000 - 00000000bf503000 (reserved)
Feb 27 18:38:07 173 kernel: BIOS-e820: 00000000bf503000 - 00000000bf50d000 (ACPI NVS)
Feb 27 18:38:07 173 kernel: BIOS-e820: 00000000bf50d000 - 00000000bf533000 (reserved)
Feb 27 18:38:07 173 kernel: BIOS-e820: 00000000bf533000 - 00000000bf576000 (ACPI NVS)
Feb 27 18:38:07 173 kernel: BIOS-e820: 00000000bf576000 - 00000000bf800000 (usable)
Feb 27 18:38:07 173 kernel: BIOS-e820: 00000000fed1c000 - 00000000fed40000 (reserved)
Feb 27 18:38:07 173 kernel: BIOS-e820: 00000000ff000000 - 0000000100000000 (reserved)
Feb 27 18:38:07 173 kernel: BIOS-e820: 0000000100000000 - 0000000240000000 (usable)
Feb 27 18:38:07 173 kernel: DMI 2.7 present.
Feb 27 18:38:07 173 kernel: SMBIOS version 2.7 @ 0xF0480
Feb 27 18:38:07 173 kernel: AMI BIOS detected: BIOS may corrupt low RAM, working around it.
Feb 27 18:38:07 173 kernel: last_pfn = 0x240000 max_arch_pfn = 0x400000000
Feb 27 18:38:07 173 kernel: x86 PAT enabled: cpu 0, old 0x7040600070406, new 0x7010600070106
Feb 27 18:38:07 173 kernel: total RAM covered: 8192M
Feb 27 18:38:07 173 kernel: Found optimal setting for mtrr clean up
Feb 27 18:38:07 173 kernel: gran_size: 64K  chunk_size: 64K     num_reg: 4      lose cover RAM: 0G
Feb 27 18:38:07 173 kernel: last_pfn = 0xbf800 max_arch_pfn = 0x400000000
Feb 27 18:38:07 173 kernel: init_memory_mapping: 0000000000000000-00000000bf800000
Feb 27 18:38:07 173 kernel: init_memory_mapping: 0000000100000000-0000000240000000
Feb 27 18:38:07 173 kernel: RAMDISK: 3711a000 - 37fef46f
Feb 27 18:38:07 173 kernel: ACPI: RSDP 00000000000f0450 00024 (v02 SUPERM)
Feb 27 18:38:07 173 kernel: ACPI: XSDT 00000000be7f4078 00074 (v01 SUPERM SMCI--MB 00000001 AMI  00010013)
Feb 27 18:38:07 173 kernel: ACPI: FACP 00000000be7faf40 000F4 (v04 SUPERM SMCI--MB 00000001 AMI  00010013)
Feb 27 18:38:07 173 kernel: ACPI: DSDT 00000000be7f4180 06DC0 (v02 SUPERM SMCI--MB 00000000 INTL 20051117)
Feb 27 18:38:07 173 kernel: ACPI: FACS 00000000bf50af80 00040
Feb 27 18:38:07 173 kernel: ACPI: APIC 00000000be7fb038 00092 (v03 SUPERM SMCI--MB 00000001 AMI  00010013)
Feb 27 18:38:07 173 kernel: ACPI: SSDT 00000000be7fb0d0 001D6 (v01 AMICPU     PROC 00000001 MSFT 03000001)
Feb 27 18:38:07 173 kernel: ACPI: MCFG 00000000be7fb2a8 0003C (v01 SUPERM SMCI--MB 00000001 MSFT 00000097)
Feb 27 18:38:07 173 kernel: ACPI: HPET 00000000be7fb2e8 00038 (v01 SUPERM SMCI--MB 00000001 AMI. 00000004)
Feb 27 18:38:07 173 kernel: ACPI: SPMI 00000000be7fb320 00040 (v05 A M I   OEMSPMI 00000000 AMI. 00000000)
Feb 27 18:38:07 173 kernel: ACPI: EINJ 00000000be7fb360 00130 (v01    AMI AMI EINJ 00000000      00000000)
Feb 27 18:38:07 173 kernel: ACPI: ERST 00000000be7fb490 00210 (v01  AMIER AMI ERST 00000000      00000000)
Feb 27 18:38:07 173 kernel: ACPI: HEST 00000000be7fb6a0 000A8 (v01    AMI AMI HEST 00000000      00000000)
Feb 27 18:38:07 173 kernel: ACPI: BERT 00000000be7fb748 00030 (v01    AMI AMI BERT 00000000      00000000)
Feb 27 18:38:07 173 kernel: No NUMA configuration found
Feb 27 18:38:07 173 kernel: Faking a node at 0000000000000000-0000000240000000
Feb 27 18:38:07 173 kernel: Bootmem setup node 0 0000000000000000-0000000240000000
Feb 27 18:38:07 173 kernel:  NODE_DATA [0000000000017000 - 000000000004afff]
Feb 27 18:38:07 173 kernel:  bootmap [000000000004b000 -  0000000000092fff] pages 48
Feb 27 18:38:07 173 kernel: (8 early reservations) ==> bootmem [0000000000 - 0240000000]
Feb 27 18:38:07 173 kernel:  #0 [0000000000 - 0000001000]   BIOS data page ==> [0000000000 - 0000001000]
Feb 27 18:38:07 173 kernel:  #1 [0000006000 - 0000008000]       TRAMPOLINE ==> [0000006000 - 0000008000]
Feb 27 18:38:07 173 kernel:  #2 [0001000000 - 000200c7e4]    TEXT DATA BSS ==> [0001000000 - 000200c7e4]
Feb 27 18:38:07 173 kernel:  #3 [003711a000 - 0037fef46f]          RAMDISK ==> [003711a000 - 0037fef46f]
Feb 27 18:38:07 173 kernel:  #4 [000009b800 - 0000100000]    BIOS reserved ==> [000009b800 - 0000100000]
Feb 27 18:38:07 173 kernel:  #5 [000200d000 - 000200d3a8]              BRK ==> [000200d000 - 000200d3a8]
Feb 27 18:38:07 173 kernel:  #6 [0000010000 - 0000012000]          PGTABLE ==> [0000010000 - 0000012000]
Feb 27 18:38:07 173 kernel:  #7 [0000012000 - 0000017000]          PGTABLE ==> [0000012000 - 0000017000]
Feb 27 18:38:07 173 kernel: found SMP MP-table at [ffff8800000fcdc0] fcdc0
Feb 27 18:38:07 173 kernel: Reserving 129MB of memory at 48MB for crashkernel (System RAM: 9216MB)
Feb 27 18:38:07 173 kernel: Zone PFN ranges:
Feb 27 18:38:07 173 kernel:  DMA      0x00000010 -> 0x00001000
Feb 27 18:38:07 173 kernel:  DMA32    0x00001000 -> 0x00100000
Feb 27 18:38:07 173 kernel:  Normal   0x00100000 -> 0x00240000
Feb 27 18:38:07 173 kernel: Movable zone start PFN for each node
Feb 27 18:38:07 173 kernel: early_node_map[5] active PFN ranges
Feb 27 18:38:07 173 kernel:    0: 0x00000010 -> 0x0000009b
Feb 27 18:38:07 173 kernel:    0: 0x00000100 -> 0x000be7a8
Feb 27 18:38:07 173 kernel:    0: 0x000bf4b0 -> 0x000bf4b2
Feb 27 18:38:07 173 kernel:    0: 0x000bf576 -> 0x000bf800
Feb 27 18:38:07 173 kernel:    0: 0x00100000 -> 0x00240000
Feb 27 18:38:07 173 kernel: ACPI: PM-Timer IO Port: 0x408
Feb 27 18:38:07 173 kernel: ACPI: LAPIC (acpi_id[0x01] lapic_id[0x00] enabled)
Feb 27 18:38:07 173 kernel: ACPI: LAPIC (acpi_id[0x02] lapic_id[0x02] enabled)
Feb 27 18:38:07 173 kernel: ACPI: LAPIC (acpi_id[0x03] lapic_id[0x04] enabled)
Feb 27 18:38:07 173 kernel: ACPI: LAPIC (acpi_id[0x04] lapic_id[0x06] enabled)
Feb 27 18:38:07 173 kernel: ACPI: LAPIC (acpi_id[0x05] lapic_id[0x01] enabled)
Feb 27 18:38:07 173 kernel: ACPI: LAPIC (acpi_id[0x06] lapic_id[0x03] enabled)
Feb 27 18:38:07 173 kernel: ACPI: LAPIC (acpi_id[0x07] lapic_id[0x05] enabled)
Feb 27 18:38:07 173 kernel: ACPI: LAPIC (acpi_id[0x08] lapic_id[0x07] enabled)
Feb 27 18:38:07 173 kernel: ACPI: LAPIC_NMI (acpi_id[0xff] high edge lint[0x1])
Feb 27 18:38:07 173 kernel: ACPI: IOAPIC (id[0x00] address[0xfec00000] gsi_base[0])
Feb 27 18:38:07 173 kernel: IOAPIC[0]: apic_id 0, version 32, address 0xfec00000, GSI 0-23
Feb 27 18:38:07 173 kernel: ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 2 dfl dfl)
Feb 27 18:38:07 173 kernel: ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level)
Feb 27 18:38:07 173 kernel: Using ACPI (MADT) for SMP configuration information
Feb 27 18:38:07 173 kernel: ACPI: HPET id: 0x8086a701 base: 0xfed00000
Feb 27 18:38:07 173 kernel: SMP: Allowing 8 CPUs, 0 hotplug CPUs
Feb 27 18:38:07 173 kernel: PM: Registered nosave memory: 000000000009b000 - 000000000009c000
Feb 27 18:38:07 173 kernel: PM: Registered nosave memory: 000000000009c000 - 00000000000a0000
Feb 27 18:38:07 173 kernel: PM: Registered nosave memory: 00000000000a0000 - 00000000000e0000
Feb 27 18:38:07 173 kernel: PM: Registered nosave memory: 00000000000e0000 - 0000000000100000
Feb 27 18:38:07 173 kernel: PM: Registered nosave memory: 00000000be7a8000 - 00000000be7f4000
Feb 27 18:38:07 173 kernel: PM: Registered nosave memory: 00000000be7f4000 - 00000000be7fc000
Feb 27 18:38:07 173 kernel: PM: Registered nosave memory: 00000000be7fc000 - 00000000bf47a000
Feb 27 18:38:07 173 kernel: PM: Registered nosave memory: 00000000bf47a000 - 00000000bf47b000
Feb 27 18:38:07 173 kernel: PM: Registered nosave memory: 00000000bf47b000 - 00000000bf48c000
Feb 27 18:38:07 173 kernel: PM: Registered nosave memory: 00000000bf48c000 - 00000000bf48f000
Feb 27 18:38:07 173 kernel: PM: Registered nosave memory: 00000000bf48f000 - 00000000bf4b0000
Feb 27 18:38:07 173 kernel: PM: Registered nosave memory: 00000000bf4b2000 - 00000000bf503000
Feb 27 18:38:07 173 kernel: PM: Registered nosave memory: 00000000bf503000 - 00000000bf50d000
Feb 27 18:38:07 173 kernel: PM: Registered nosave memory: 00000000bf50d000 - 00000000bf533000
Feb 27 18:38:07 173 kernel: PM: Registered nosave memory: 00000000bf533000 - 00000000bf576000
Feb 27 18:38:07 173 kernel: PM: Registered nosave memory: 00000000bf800000 - 00000000fed1c000
Feb 27 18:38:07 173 kernel: PM: Registered nosave memory: 00000000fed1c000 - 00000000fed40000
Feb 27 18:38:07 173 kernel: PM: Registered nosave memory: 00000000fed40000 - 00000000ff000000
Feb 27 18:38:07 173 kernel: PM: Registered nosave memory: 00000000ff000000 - 0000000100000000
Feb 27 18:38:07 173 kernel: Allocating PCI resources starting at bf800000 (gap: bf800000:3f51c000)

Há mais, mas não posso compartilhá-lo aqui porque há um limite de 30.000 caracteres para uma postagem.

EDITAR: COMO O ÚLTIMO TEMPO , meus multipackets receberam um número aumentado na época do incidente.

04:20:01 PM      eth1     82.02     84.18     13.40     93.86      0.00      0.00      0.00
04:30:01 PM        lo      0.03      0.03      0.00      0.00      0.00      0.00      0.00
04:30:01 PM      eth0      0.00      0.00      0.00      0.00      0.00      0.00      0.00
04:30:01 PM      eth1     72.94     74.44      7.29     86.59      0.00      0.00      0.00
04:40:01 PM        lo      0.01      0.01      0.00      0.00      0.00      0.00      0.00
04:40:01 PM      eth0      0.00      0.00      0.00      0.00      0.00      0.00      0.00
04:40:01 PM      eth1     77.25     83.17      6.75     99.82      0.00      0.00      0.00
04:50:01 PM        lo      0.01      0.01      0.00      0.00      0.00      0.00      0.00
04:50:01 PM      eth0      0.00      0.00      0.00      0.00      0.00      0.00      0.00
04:50:01 PM      eth1     71.76     77.19      6.24     91.93      0.00      0.00      0.00
05:00:01 PM        lo      0.00      0.00      0.00      0.00      0.00      0.00      0.00
05:00:01 PM      eth0      0.00      0.00      0.00      0.00      0.00      0.00      0.00
05:00:01 PM      eth1     64.39     63.84      8.28     71.20      0.00      0.00      0.00
05:10:01 PM        lo      0.03      0.03      0.00      0.00      0.00      0.00      0.00
05:10:01 PM      eth0      0.00      0.00      0.00      0.00      0.00      0.00      0.00
05:10:01 PM      eth1     65.18     66.56      5.77     76.39      0.00      0.00      0.00
05:20:01 PM        lo      0.03      0.03      0.00      0.00      0.00      0.00      0.00
05:20:01 PM      eth0      0.00      0.00      0.00      0.00      0.00      0.00      0.00
05:20:01 PM      eth1     92.23     89.68     33.78     88.57      0.00      0.00      0.00
05:30:01 PM        lo      0.00      0.00      0.00      0.00      0.00      0.00      0.00
05:30:01 PM      eth0      0.00      0.00      0.00      0.00      0.00      0.00      0.00
05:30:01 PM      eth1     73.42     74.93      8.05     87.59      0.00      0.00      0.00
05:40:01 PM        lo      0.03      0.03      0.00      0.00      0.00      0.00      0.00
05:40:01 PM      eth0      0.00      0.00      0.00      0.00      0.00      0.00      0.00
05:40:01 PM      eth1     60.54     58.69     19.79     59.61      0.00      0.00 507865361.98
05:50:01 PM        lo      0.00      0.00      0.00      0.00      0.00      0.00      0.00
05:50:01 PM      eth0      0.00      0.00      0.00      0.00      0.00      0.00      0.00
05:50:01 PM      eth1      0.00      0.00      0.00      0.00      0.00      0.00 2146553474.33
06:00:01 PM        lo      0.00      0.00      0.00      0.00      0.00      0.00      0.00
06:00:01 PM      eth0      0.00      0.00      0.00      0.00      0.00      0.00      0.00
06:00:01 PM      eth1      0.00      0.00      0.00      0.00      0.00      0.00 2150279010.21

06:00:01 PM     IFACE   rxpck/s   txpck/s    rxkB/s    txkB/s   rxcmp/s   txcmp/s  rxmcst/s
06:10:01 PM        lo      0.00      0.00      0.00      0.00      0.00      0.00      0.00
06:10:01 PM      eth0      0.00      0.00      0.00      0.00      0.00      0.00      0.00
06:10:01 PM      eth1      0.00      0.00      0.00      0.00      0.00      0.00 2145874241.82
06:20:01 PM        lo      0.00      0.00      0.00      0.00      0.00      0.00      0.00
06:20:01 PM      eth0      0.00      0.00      0.00      0.00      0.00      0.00      0.00
06:20:01 PM      eth1      0.00      0.00      0.00      0.00      0.00      0.00 2150063723.97
06:30:01 PM        lo      0.00      0.00      0.00      0.00      0.00      0.00      0.00
06:30:01 PM      eth0      0.00      0.00      0.00      0.00      0.00      0.00      0.00
06:30:01 PM      eth1      0.00      0.00      0.00      0.00      0.00      0.00 2146303180.75
Average:           lo      0.01      0.01      0.00      0.00      0.00      0.00      0.00
Average:         eth0      0.00      0.00      0.00      0.00      0.00      0.00      0.00
Average:         eth1    122.77    119.70     24.14     84.60      0.00      0.00 101305280.31

06:38:02 PM       LINUX RESTART

06:40:01 PM     IFACE   rxpck/s   txpck/s    rxkB/s    txkB/s   rxcmp/s   txcmp/s  rxmcst/s
06:50:01 PM        lo      0.00      0.00      0.00      0.00      0.00      0.00      0.00

EDITAR: /var/log/secure na época do incidente:

Feb 27 18:35:15 173 runuser: pam_unix(runuser:session): session opened for user qpidd by (uid=0)
Feb 27 18:35:15 173 runuser: pam_unix(runuser:session): session closed for user qpidd
Feb 27 18:35:16 173 sshd[1774]: Received signal 15; terminating.
Feb 27 18:35:16 173 sshd[5490]: Exiting on signal 15
Feb 27 18:35:16 173 sshd[5500]: Exiting on signal 15
Feb 27 18:35:16 173 sshd[5500]: pam_unix(sshd:session): session closed for user root
Feb 27 18:35:16 173 sshd[5490]: pam_unix(sshd:session): session closed for user root
Feb 27 18:35:16 173 sshd[5510]: Exiting on signal 15
Feb 27 18:35:16 173 sshd[5520]: Exiting on signal 15
Feb 27 18:35:16 173 sshd[5510]: pam_unix(sshd:session): session closed for user root
Feb 27 18:35:16 173 sshd[5520]: pam_unix(sshd:session): session closed for user root
Feb 27 18:35:16 173 sshd[23046]: Exiting on signal 15
Feb 27 18:35:16 173 sshd[23056]: Exiting on signal 15
Feb 27 18:35:16 173 sshd[23066]: Exiting on signal 15
Feb 27 18:35:16 173 sshd[23046]: pam_unix(sshd:session): session closed for user root
Feb 27 18:35:16 173 sshd[23056]: pam_unix(sshd:session): session closed for user root
Feb 27 18:35:16 173 sshd[23066]: pam_unix(sshd:session): session closed for user root
Feb 27 18:35:16 173 sshd[23076]: Exiting on signal 15
Feb 27 18:35:16 173 sshd[23076]: pam_unix(sshd:session): session closed for user root
Feb 27 18:38:19 173 sshd[5112]: Server listening on 0.0.0.0 port 22.
Feb 27 18:38:19 173 sshd[5112]: Server listening on :: port 22.
Feb 27 18:38:20 173 runuser: pam_unix(runuser:session): session opened for user qpidd by (uid=0)
Feb 27 18:38:20 173 runuser: pam_unix(runuser:session): session closed for user qpidd
Feb 27 18:38:20 173 runuser: pam_unix(runuser:session): session opened for user qpidd by (uid=0)
Feb 27 18:38:20 173 runuser: pam_unix(runuser:session): session closed for user qpidd
Feb 27 18:38:20 173 runuser: pam_unix(runuser-l:session): session opened for user qpidd by (uid=0)
Feb 27 18:38:20 173 runuser: pam_unix(runuser-l:session): session closed for user qpidd
Feb 27 18:38:34 173 sshd[5349]: Accepted publickey for root from MY IP port 40702 ssh2
Feb 27 18:38:34 173 sshd[5349]: pam_unix(sshd:session): session opened for user root by (uid=0)
Feb 27 18:40:57 173 sshd[5349]: Received disconnect from MY IP: 11: disconnected by user
Feb 27 18:40:57 173 sshd[5349]: pam_unix(sshd:session): session closed for user root

Então, quando tento conectar-me pela primeira vez após o incidente, parece que ele aceitaria minha publickey, mas não responderia.

    
por Emil 28.02.2012 / 17:33

1 resposta

2

Verifique / var / log / secure - se houver muitas tentativas com falha, o sshd pode estar sendo suspenso

Se este for o caso, você provavelmente deseja passar para uma autenticação baseada em chave ou instalar algo como Negar hosts

    
por 28.02.2012 / 20:14

Tags