ssh Write failed: Broken pipe

shogun1234 · 11-29-2010, 11:49 PM

My env is Debian squeeze with v2.6.32-5.686 kernel, and ssh 5.5p1 Debian 5+b1 openssl 0.9.8o. The os is installed on virtualbox 3.2.10

I keep getting `Write failed: Broken pipe' when logining to debian box. After searching on the internet, most people suggest change .ssh/config by adding ServerAliveInterval parameter. However, several values has been tested e.g. 30, 50, 120, but none of them prevent from this occurred again.

Is there any good way to test what might happen behind e.g. network, etc.? Or anything I can tune?

I appreciate any suggestions.
Thanks.

unSpawn · 11-30-2010, 05:59 PM

- In what way does your system and user setup differ from the standard? (In other words: what modifications did you make?)
- What does syslog (and wherever SSH is configured to log to) say around the time of the login?
- What does running your ssh session in verbose mode (add "-vvv") say? (Attach as plain text?)

shogun1234 · 12-08-2010, 03:13 AM

Quote:

Originally Posted by unSpawn

- In what way does your system and user setup differ from the standard? (In other words: what modifications did you make?)
- What does syslog (and wherever SSH is configured to log to) say around the time of the login?
- What does running your ssh session in verbose mode (add "-vvv") say? (Attach as plain text?)

The setting comes with a clean debian squeeze installation. The only change is the config in /etc/ssh/sshd_config where PermitRootLogin was changed from yes to no avoiding rkhunter reports warning.

In /var/log/syslog or /var/log/message I do not discover any ssh message reported; I open files content to read and use e.g. `grep -i ssh /var/log/message' or `grep -i ssh /var/log/syslog' do not show any ssh message. Maybe I may use the wrong key word. With which key word I need to check in the log file?

In /etc/ssh/sshd_config, the logging level is as below

Code:

SyslogFacility Auth
LogLevel Info

The client side running `ssh -vvv user@ssh_host' shows

Code:

OpenSSH_5.5p1 Debian-5+b1, OpenSSL 0.9.8o 01 Jun 2010
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to ssh_host [aaa.bbb.ccc.ddd] port 22.
debug1: connect to address aaa.bbb.ccc.ddd port 22: Connection refused
ssh: connect to host aaa.bbb.ccc.ddd port 22: Connection refused

But the server executing `netstat -tulp' can see ssh port is opened.

Code:

tcp 0 0 *:ssh *:*  LISTEN pid_number/sshd

Also, after broken pipe occurs, unless to do reboot, the client can not get in even restarting sshd service e.g. `/etc/init.d/ssh restart'

What might be the root cause and how to fix it?
Thanks for the help.

shogun1234 · 12-08-2010, 09:33 PM

After searching on the internet, I came across to read this thread - http://serverfault.com/questions/207480, concerning massive packet lost.

I change /proc/sys/net/ipv4/conf/all/arp_filter value from 0 to 1; and the machine which suffers `broken pipes' looking ok at the moment, but I do not know if this solves my problem or not because I do not know how to check e.g. packets loss.