wierd ssh server problem, what just happened?

frieza · 02-07-2011, 03:29 PM

at the computer shop we have an ubuntu 9.10 server that we log into via ssh or webmin

today i was trying to ssh into the machine and got connection refused, so i logged into webmin and found the ssh server not running

when i tried to start with webmin it i got the error

Code:

failed to start ssh server
* /dev/null not a character device

went over to the shell command part of webmin and issued ls /dev -l and looked at the output and found something of concern

Code:

-rw-rw-rw-  1 root   root           0 2011-02-07 14:23 null
-rw-rw-rw-  1 root   root          76 2011-02-06 07:38 null.1
-rw-rw-rw-  1 root   root           0 2011-01-30 07:41 null.2
crw-rw-rw-  1 root   root      1,   3 2011-01-23 08:55 null.3

the obvious answer for the short term was

Code:

#rm -f /dev/null
#mv /dev/null.3 /dev/null

but that is only a temporary fix if whatever caused that is running periodically
i need to get at the root of the problem and not just treat the symptom

what would do this and why and how can i prevent such a thing from happening again?

AlucardZero · 02-07-2011, 03:33 PM

It looks like something is rotating /dev/null every week. Check your logrotate config files.

Proper /dev/null reconstruction, from "man null":

Code:

 mknod -m 666 /dev/null c 1 3
              chown root:root /dev/null

frieza · 02-07-2011, 04:24 PM

upon further investigation /dev/null.1 contained the following line

Code:

ls: cannot access /var/cache/apt/archives//*.deb: No such file or directory

none of the logrotates conf files seem to have anything that would do that [see attachment]