[CentOS] SSH suddenly started failing :(

Thu Jun 7 18:57:07 UTC 2007
Ross S. W. Walker <rwalker at medallion.com>

> -----Original Message-----
> From: centos-bounces at centos.org 
> [mailto:centos-bounces at centos.org] On Behalf Of Paul Heinlein
> Sent: Thursday, June 07, 2007 2:36 PM
> To: CentOS mailing list
> Subject: Re: [CentOS] SSH suddenly started failing :(
> 
> On Thu, 7 Jun 2007, John Lagrue wrote:
> 
> > Cameron Showalter wrote:
> >>  John Lagrue wrote:
> >> 
> >> >  All of a sudden I can no longer ssh into my server 
> running CentOS 4.5
> >> > 
> >> >  This is what happens:
> >> > 
> >> >  [john at lt-131-jdl-f7 ~]$ ssh -Y -p 2222 192.168.0.1
> >> >  john at 192.168.0.1's password:
> >> >  Connection to 192.168.0.1 closed by remote host.
> >> >  Connection to 192.168.0.1 closed.
> >> > 
> >> >  And yes, the account does exist and the password is correct!
> >> > 
> >> >  Looking at the logs, I see this:
> >> > 
> >> >  Jun  7 18:51:37 moray1 sshd(pam_unix)[11348]: 
> authentication failure;
> >> >  logname= uid=0 euid=0 tty=NODEVssh ruser= 
> rhost=192.168.0.209  user=john
> >> >  Jun  7 18:51:46 moray1 sshd[11348]: Accepted password 
> for john from
> >> > : : ffff:192.168.0.209 port 57755 ssh2
> >> >  Jun  7 18:51:46 moray1 sshd(pam_unix)[11352]: session 
> opened for user
> >> >  john by (uid=500)
> >> >  Jun  7 18:51:46 moray1 pam_loginuid[11352]: set_loginuid failed
> >> >  opening loginuid Jun  7 18:51:46 moray1 pam_loginuid[11352]:
> >> >  set_loginuid failed
> >> >  Does any of this make sense?
> >> > 
> >> >  I've tried it on three different clients and get the 
> same thing every
> >> >  time.
> >> > 
> >> >  JDL
> >> > 
> >> >  Jun  7 18:51:46 moray1 sshd[11352]: fatal: PAM session setup
> >> >  failed[14]: Cannot make/remove an entry for the 
> specified session
> 
> This last entry smells to me like it might be a disk-full error. Even 
> if df reports lots of space free, it might be worth using lsof to see 
> whether there are file descriptors open to large (but seemingly 
> deleted) files.

Or if it is out of inodes on /var but plenty of blocks left...

-Ross

______________________________________________________________________
This e-mail, and any attachments thereto, is intended only for use by
the addressee(s) named herein and may contain legally privileged
and/or confidential information. If you are not the intended recipient
of this e-mail, you are hereby notified that any dissemination,
distribution or copying of this e-mail, and any attachments thereto,
is strictly prohibited. If you have received this e-mail in error,
please immediately notify the sender and permanently delete the
original and any copy or printout thereof.