Skip to content

Instantly share code, notes, and snippets.

@kkkrist
Created June 14, 2021 08:07
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save kkkrist/5e987254b8a7a5811434d66f017db4d0 to your computer and use it in GitHub Desktop.
Save kkkrist/5e987254b8a7a5811434d66f017db4d0 to your computer and use it in GitHub Desktop.
sshd crashing
U Thu Jun 10 15:52:03 2021 2 systemd-coredump@16-25347-0.service systemd-coredump[25348]: Process 25235 (sshd) of user 99 dumped core.
Stack trace of thread 25235:
#0 0x00007fb62d426e8b __socket (libc.so.6 + 0xffe8b)
#1 0x00007fb62d41f707 openlog_internal (libc.so.6 + 0xf8707)
#2 0x00007fb62d41fbe7 __vsyslog_internal (libc.so.6 + 0xf8be7)
#3 0x00007fb62d41fef3 __syslog_chk (libc.so.6 + 0xf8ef3)
#4 0x000055c6232d2964 n/a (sshd + 0x65964)
#5 0x000055c6232d30f4 n/a (sshd + 0x660f4)
#6 0x000055c6232d046c n/a (sshd + 0x6346c)
#7 0x000055c6232a0e48 n/a (sshd + 0x33e48)
#8 0x000055c6232d28de n/a (sshd + 0x658de)
#9 0x000055c6232d30f4 n/a (sshd + 0x660f4)
#10 0x000055c6232d3381 n/a (sshd + 0x66381)
#11 0x000055c62327c386 n/a (sshd + 0xf386)
#12 0x00007fb62d363da0 __restore_rt (libc.so.6 + 0x3cda0)
#13 0x00007fb62d41d197 __select (libc.so.6 + 0xf6197)
#14 0x000055c6232d9ad5 n/a (sshd + 0x6cad5)
#15 0x000055c6232dfa43 n/a (sshd + 0x72a43)
#16 0x000055c6232dfb49 n/a (sshd + 0x72b49)
#17 0x000055c62328c551 n/a (sshd + 0x1f551)
#18 0x000055c623279915 n/a (sshd + 0xc915)
#19 0x00007fb62d34eb25 __libc_start_main (libc.so.6 + 0x27b25)
#20 0x000055c62327c0ae n/a (sshd + 0xf0ae)
@kkkrist
Copy link
Author

kkkrist commented Jun 14, 2021

  • Password-guessing on sshd (slow and infrequent brute-force attack?)
  • Conducted by two different IPs, only on weekends
  • sshd crashes after the 2nd or 3rd attempt w/ common/unspecific user names
  • Up-to-date ArchLinux install on x86_64, currently running openssh 8.6p1-1
  • Happens to other users too => https://bbs.archlinux.org/viewtopic.php?id=265221

Session logs (systemd-journald) and packet captures available

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment