[plug] port 22 opens and closes randomly?

[Michael Collard]

Something this random *shouldn't* be software... I'd start with checking
kernel logs and dmesg for network related events (maybe it can't auto
sense the duplex or bandwidth properly or something?).

To test if it is software, make a script to check iptables rules and
other processes or something every 1 second or so and log it... then
check the log. 

Good luck


On Sun, 2008-03-16 at 21:56 +1100, Rob Dunne wrote:
> Hi Pluggers,
> 
> I have a small server running Debian etch. It is actually a NAS
> that has been flashed and had freelink installed
> http://buffalo.nas-central.org/index.php/FreeLink_for_the_Linkstation_Pro
> but I dont think this is relevant to this problem (but then, I
> dont really know).
> 
> Sometimes it boots with port 22 closed so I cant ssh to it and I
> cant mount it (SMB connection failed).  Sometimes it lets me on
> for an instant ie
> 
> BUFFALO INC. LinkStation series LS-GL(IESADA)
> root at LS-GL7D6:~#
> root at LS-GL7D6:~# Read from remote host 192.168.1.101: Connection reset 
> by peer
> Connection to 192.168.1.101 closed.
> 
> sudo nmap  -p 1-2500 -O 192.168.1.101
> All 2500 scanned ports on ls-gl7d6 (192.168.1.101) are closed
> 
> but a moment later
> 
> sudo nmap  -p 20-25 -O 192.168.1.101
> Starting Nmap 4.20 ( http://insecure.org ) at 2008-02-24 19:45 EST
> Interesting ports on ls-gl7d6 (192.168.1.101):
> PORT   STATE  SERVICE
> 20/tcp closed ftp-data
> 21/tcp closed ftp
> 22/tcp open   ssh
> 
> so ssh port 22 is opened and closed seemingly randomly.
> 
> When this happens I have been able to get it back to the
> emergency boot mode and then it back to FreeLink on the next boot. 
> However for the
> last 5 boots it has come up in the "no ssh" state.
> 
> What could do this? I have set the log level in sshd_config to DEBUG3
> but I dont see anything helpful. Where else should I look for a clue?
> 
> Bye
> Rob
> 
> _______________________________________________
> PLUG discussion list: plug at plug.org.au
> http://www.plug.org.au/mailman/listinfo/plug
> Committee e-mail: committee at plug.linux.org.au