[j-nsp] ssh/tcp: bind: Address already in use

[Matt Yaklin]

On Sun, 16 Oct 2005, Randy Bush wrote:

> [ sorry, an out of order in that last ]
>
> root at foo% ps -aux | grep inet
> root  2568  0.0  0.1  1284  796  ??  I     3Oct05   0:00.41 /usr/sbin/inetd -N
>

this process was started first. oct 3rd 2005.

> root at foo% grep ssh /etc/inetd.conf
> ssh stream tcp nowait/6/150 root /usr/sbin/sshd sshd -i -f /var/etc/sshd_conf
> ssh stream tcp6 nowait/6/150 root /usr/sbin/sshd sshd -i -f /var/etc/sshd_conf
>
> root at foo% ps -aux | grep ssh
> root 24098  0.0  0.2  5252 1816  ??  Ss   12:35AM   0:00.17 sshd: root at ttyp0 (s
> root 22527  0.0  0.2  2636 1648  ??  Is   Sun12AM   0:15.06 /usr/sbin/sshd
>

sshd came along today at 12am. Who started it? Can you use last to find
out who was using this box? It appears it was ran by hand as root from the
shell.

> root at foo% kill 22527
>
> root at foo% ps -aux | grep ssh
> root 24098  0.0  0.2  5252 1816  ??  Ss   12:35AM   0:00.17 sshd: root at ttyp0 (s
> root 24198  0.0  0.0   268  148  p0  R+    2:00AM   0:00.00 grep ssh
>
> feen:/usr/home/randy> ssh root at foo
> ssh: connect to host foo port 22: Connection refused
>

Maybe give inetd a HUP because it is confused also. It really should
have launched a sshd ran from inetd.

I really do wonder who started that daemon today at noon.

m

> ok, i am confused
>
> randy
>