0

My auth.log on my Debian machines was full of the following messages:

CRON[1736]: pam_unix(cron:session): session opened for user root by (uid=0)
sshd[1742]: Connection closed by ::1 port 38518 [preauth]
CRON[1736]: pam_unix(cron:session): session closed for user root
sshd[1748]: Connection closed by ::1 port 38592 [preauth]
CRON[1752]: pam_unix(cron:session): session opened for user root by (uid=0)
sshd[1758]: Connection closed by ::1 port 38672 [preauth]
...

As per the instructions here I added the following line to /etc/pam.d/common-session-noninteractive:

session    [success=1 default=ignore] pam_succeed_if.so service in cron quiet use_uid

However, the following lines keep being added to the auth.log file:

Jun 17 10:39:47 <machine> sshd[2175]: Connection closed by ::1 port 41262 [preauth]
Jun 17 10:40:21 <machine> sshd[2188]: Connection closed by ::1 port 41340 [preauth]
Jun 17 10:40:54 <machine> sshd[2194]: Connection closed by ::1 port 41416 [preauth]
Jun 17 10:41:28 <machine> sshd[2205]: Connection closed by ::1 port 41494 [preauth]
Jun 17 10:42:02 <machine> sshd[2228]: Connection closed by ::1 port 41576 [preauth]
Jun 17 10:42:35 <machine> sshd[2235]: Connection closed by ::1 port 41668 [preauth]
Jun 17 10:43:09 <machine> sshd[2246]: Connection closed by ::1 port 41764 [preauth]
Jun 17 10:43:42 <machine> sshd[2252]: Connection closed by ::1 port 41842 [preauth]
Jun 17 10:44:16 <machine> sshd[2262]: Connection closed by ::1 port 41922 [preauth]
Jun 17 10:44:50 <machine> sshd[2269]: Connection closed by ::1 port 41998 [preauth]
Jun 17 10:45:23 <machine> sshd[2285]: Connection closed by ::1 port 42084 [preauth]
Jun 17 10:45:57 <machine> sshd[2292]: Connection closed by ::1 port 42164 [preauth]
...

And I'm not sure how to get rid of these. First of all it shows IP(v6) ::1 (so localhost). But just to be sure: the host is not reachable from the outside world (let alone via IPv6, since IPv6 is not enabled on my connection) and is behind an OpenBSD gateway/firewall. ::1 is most likely something ran on my local machine. So I was pretty sure it came from a cronjob that is run every minute. And that cronjob looks a bit like this:

php foo.php
sleep 30
php foo.php

Which is just a (shitty) way to run a PHP script every 30 seconds. The script finishes in seconds.

However, what is weird is if you look at the log times. You'd expect an entry at the whole minute (+/- a second or two) and then, maybe, another one every half minute (+/- a few seconds depending on how long the first script took + 30 seconds). But that's not the case. The time between each log line is 34, 33, 34, 34, 33, 34, 33, 34, 34, 33, 34, ... seconds respectively. That means the time is 'drifting'.

Even weirder: if I comment out the crobtab line with the job running every minute then the "Connection closed by..." lines KEEP coming. Even though that particular job/script was disabled. So that tells me it's probably not the cronjob causing these lines. There's no other cronjobs that would explain this either.

I then ran a tcpdump:

tcpdump -i lo port 22

And, sure enough, if I wait a little I see traffic come in:

11:18:29.548247 IP6 localhost.46846 > localhost.ssh: Flags [S], seq 1675216317, win 43690, options [mss 65476,sackOK,TS val 1107033 ecr 0,nop,wscale 7], length 0
11:18:29.548270 IP6 localhost.ssh > localhost.46846: Flags [S.], seq 3867254410, ack 1675216318, win 43690, options [mss 65476,sackOK,TS val 1107033 ecr 1107033,nop,wscale 7], length 0
11:18:29.548279 IP6 localhost.46846 > localhost.ssh: Flags [.], ack 1, win 342, options [nop,nop,TS val 1107033 ecr 1107033], length 0
11:18:29.551956 IP6 localhost.ssh > localhost.46846: Flags [P.], seq 1:40, ack 1, win 342, options [nop,nop,TS val 1107034 ecr 1107033], length 39
11:18:29.551967 IP6 localhost.46846 > localhost.ssh: Flags [.], ack 40, win 342, options [nop,nop,TS val 1107034 ecr 1107034], length 0
11:18:29.551982 IP6 localhost.46846 > localhost.ssh: Flags [P.], seq 1:40, ack 40, win 342, options [nop,nop,TS val 1107034 ecr 1107034], length 39
11:18:29.552005 IP6 localhost.ssh > localhost.46846: Flags [.], ack 40, win 342, options [nop,nop,TS val 1107034 ecr 1107034], length 0
11:18:29.552448 IP6 localhost.ssh > localhost.46846: Flags [P.], seq 40:792, ack 40, win 342, options [nop,nop,TS val 1107034 ecr 1107034], length 752
11:18:29.552475 IP6 localhost.46846 > localhost.ssh: Flags [F.], seq 40, ack 792, win 354, options [nop,nop,TS val 1107034 ecr 1107034], length 0
11:18:29.552778 IP6 localhost.ssh > localhost.46846: Flags [F.], seq 792, ack 41, win 342, options [nop,nop,TS val 1107034 ecr 1107034], length 0
11:18:29.552784 IP6 localhost.46846 > localhost.ssh: Flags [.], ack 793, win 354, options [nop,nop,TS val 1107034 ecr 1107034], length 0
11:19:03.202403 IP6 localhost.46962 > localhost.ssh: Flags [S], seq 4240077294, win 43690, options [mss 65476,sackOK,TS val 1115447 ecr 0,nop,wscale 7], length 0
11:19:03.202427 IP6 localhost.ssh > localhost.46962: Flags [S.], seq 3703193700, ack 4240077295, win 43690, options [mss 65476,sackOK,TS val 1115447 ecr 1115447,nop,wscale 7], length 0
11:19:03.202442 IP6 localhost.46962 > localhost.ssh: Flags [.], ack 1, win 342, options [nop,nop,TS val 1115447 ecr 1115447], length 0
11:19:03.206034 IP6 localhost.ssh > localhost.46962: Flags [P.], seq 1:40, ack 1, win 342, options [nop,nop,TS val 1115448 ecr 1115447], length 39
11:19:03.206044 IP6 localhost.46962 > localhost.ssh: Flags [.], ack 40, win 342, options [nop,nop,TS val 1115448 ecr 1115448], length 0
11:19:03.206077 IP6 localhost.46962 > localhost.ssh: Flags [P.], seq 1:40, ack 40, win 342, options [nop,nop,TS val 1115448 ecr 1115448], length 39
11:19:03.206093 IP6 localhost.ssh > localhost.46962: Flags [.], ack 40, win 342, options [nop,nop,TS val 1115448 ecr 1115448], length 0
11:19:03.206573 IP6 localhost.ssh > localhost.46962: Flags [P.], seq 40:792, ack 40, win 342, options [nop,nop,TS val 1115448 ecr 1115448], length 752
11:19:03.206601 IP6 localhost.46962 > localhost.ssh: Flags [F.], seq 40, ack 792, win 354, options [nop,nop,TS val 1115448 ecr 1115448], length 0
11:19:03.206981 IP6 localhost.ssh > localhost.46962: Flags [F.], seq 792, ack 41, win 342, options [nop,nop,TS val 1115448 ecr 1115448], length 0
11:19:03.206986 IP6 localhost.46962 > localhost.ssh: Flags [.], ack 793, win 354, options [nop,nop,TS val 1115448 ecr 1115448], length 0

And about 33/34 seconds later more traffic coming in. But, again, no clue as to where this is coming from...

So I have 2 questions:

  1. How do I find out which process / whatever is causing these loglines
  2. How do I get rid of these loglines (which may be depending on 1 ofcourse)
1

Never mind, I figured it out. It was monit monitoring the SSH deamon. I'm a dumbass. I stopped monit (service monit stop), tailed the auth.log and, whaddayaknow, no more entries. So mystery solved and monit was restarted. Now I know the cause, I don't mind these loglines as much.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.