Hide Forgot
Description of problem: After I login/logout with to a SSHv1 ssh server processes like 11385 ? Rs 1:33 sshd: root@notty Start flooding audit log with messages below. type=USER_END msg=audit(1298804960.636:894587): user pid=11385 uid=0 auid=0 ses=5536 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=localhost addr=::1 terminal=ssh res=success' type=USER_END msg=audit(1298804960.646:894588): user pid=11385 uid=0 auid=0 ses=5536 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=localhost addr=::1 terminal=ssh res=success' type=USER_END msg=audit(1298804960.646:894589): user pid=11385 uid=0 auid=0 ses=5536 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=localhost addr=::1 terminal=ssh res=success' type=USER_END msg=audit(1298804960.646:894590): user pid=11385 uid=0 auid=0 ses=5536 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=localhost addr=::1 terminal=ssh res=success' type=USER_END msg=audit(1298804960.646:894591): user pid=11385 uid=0 auid=0 ses=5536 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=localhost addr=::1 terminal=ssh res=success' type=USER_END msg=audit(1298804960.646:894592): user pid=11385 uid=0 auid=0 ses=5536 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=localhost addr=::1 terminal=ssh res=success' type=USER_END msg=audit(1298804960.646:894593): user pid=11385 uid=0 auid=0 ses=5536 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=localhost addr=::1 terminal=ssh res=success' Version-Release number of selected component (if applicable): openssh-5.3p1-40.el6.x86_64 How reproducible: 100% on all archs Steps to Reproduce: 1. set Protocol 1 in /etc/sshd_config 2. service sshd restart 3. ssh -1 root@localhost 4. exit 5. tailf /var/log/audit/audit.log Actual results: audit.log flooded by never ending USER_END messages sshd: root@notty processes hanging on the machine Expected results: audit.log not flooded, no sshd: root@notty processes hanging on the machine Additional info:
Important note: This does not happen with SSHv2 (Protocol 2 in sshd_config)
The processes cannot be killed by SIG_TERM - you have to send SIG_KILL
Corrected description: After I login/logout to a SSHv1 ssh server, processes like [snip]
This is a regression as this problem cannot be reproduced with openssh-5.3p1-40.el6.x86_64
This bug is actually caused by wrong patch in bug 642792. Closing as duplicate. *** This bug has been marked as a duplicate of bug 642792 ***
*** Bug 683456 has been marked as a duplicate of this bug. ***