LinuxQuestions.org - [SOLVED] Issue with OpenSSH 5.5p1 in RHEL 5.7 server

- Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)

- - Issue with OpenSSH 5.5p1 in RHEL 5.7 server (https://www.linuxquestions.org/questions/linux-newbie-8/issue-with-openssh-5-5p1-in-rhel-5-7-server-4175490689/)

Issue with OpenSSH 5.5p1 in RHEL 5.7 server

Hi everyone,
We just bumped into the following issue at work.
All of a sudden we could not start new ssh sessions to a RHEL 5.7 server, but existing ones were kept alive.
In those circumstances, these existing connections appeared to be handled by init (as the ssh daemon seemed to be down - it was not showing anymore in the list of running processes, invoked wither with top or ps -ef) as shown in the PPID of the following process list:

Code:

me@rhel /home/me:ps -ef | grep ssh | grep -v grep

root 6238 1 0 06:28 ? 00:00:00 sshd: user1@pts/12

root 6847 1 0 08:03 ? 00:00:00 sshd: tn2204@pts/36,pts/37

root 6956 1 0 08:41 ? 00:00:00 sshd: user2@pts/38

root 9271 1 0 06:11 ? 00:00:00 sshd: user3@pts/31

root 9910 1 0 10:17 ? 00:00:00 sshd: user4@pts/25

root 14453 1 0 07:30 ? 00:00:00 sshd: user5@pts/33

root 19932 1 0 10:23 ? 00:00:00 sshd: user6@pts/23

root 20997 1 0 10:23 ? 00:00:00 sshd: user6@pts/29

root 22245 1 0 07:35 ? 00:00:00 sshd: user7@pts/34

root 22920 1 0 Jan07 ? 00:00:00 sshd: user8@pts/24

root 27904 1 0 02:59 ? 00:00:00 sshd: user9@pts/19

root 28148 1 0 Jan02 ? 00:00:00 sshd: user10@pts/27,pts/17

root 29046 1 0 06:23 ? 00:00:00 sshd: user11@pts/5

root 30131 1 0 09:32 ? 00:00:00 sshd: user12@pts/18,pts/39

me@rhel /home/me:

Any ideas why the same process opened 2 terminals for user10 and user12 but user6 had to start 2 processes in order to open 2 terminals?
The version of OpenSSH is OpenSSH_5.5p1.
Any hints or ideas of what could have caused this issue will be more than appreciated.

Looks like SSH multiplexing causes that output in ps.

Your problem with not being able to log in probably was because SSHd was not running, though. So look at the log files for any crash reports, and check that ssh cleanly restarts.

Quote:

Originally Posted by AlucardZero (Post 5095134)

Thanks for your reply!
However, we looked in the logs and couldn't find anything in /var/log/secure nor in /var/log/audit/audit.log. Anywhere else we should look?

Try /var/log/messages. Most service process aborts get recorded there. The others are for specific classes of messages rather than general messages.