SSHD Log entries

I have a SunBlade 150 running Solaris 10, and I have the strangest problem: I keep getting SSHD log messages in /var/adm/messages:

Sep 17 14:09:46 sunshine sshd[1191]: [ID 800047 auth.crit] fatal: Read from socket failed: Connection reset by peer

Sep 17 14:14:46 sunshine sshd[1374]: [ID 800047 auth.crit] fatal: Read from socket failed: Connection reset by peer

Sep 17 14:19:46 sunshine sshd[1559]: [ID 800047 auth.crit] fatal: Read from socket failed: Connection reset by peer

Sep 17 14:24:46 sunshine sshd[2488]: [ID 800047 auth.crit] fatal: Read from socket failed: Connection reset by peer

Sep 17 14:29:46 sunshine sshd[2768]: [ID 800047 auth.crit] fatal: Read from socket failed: Connection reset by peer

Sep 17 14:34:46 sunshine sshd[3601]: [ID 800047 auth.crit] fatal: Read from socket failed: Connection reset by peer

The strange thing is that the processes mentioned are of course already terminated whenever I try to look at them, so they are very short-lived, not existing connections.

The log entries are exactly 5 minutes apart, which led me to believe it was caused by either a cron process or some weird thing in the sshd config, but none of these things are present.

External causes are also eliminated, for the messages persist even when I close down my firewall and all other machines (the log entries continue 24/7).

I tried adding keepalive messaging in my sshd config file, but again to no avail.

Anybody got any suggestions?

[1520 byte] By [p_mansvelder] at [2007-11-26 10:12:21]
# 1
Do you have any type of monitoring software that's trying to make sure that SSH is up? (Like Nagios or something?)-- Darren
Darren_Dunham at 2007-7-7 2:00:15 > top of Java-index,Solaris Operating System,Solaris Essentials - General Technical Questions...
# 2

Hi I have the same kind of problem on some servers

Oct 23 00:28:23 server sshd[29911]: [ID 800047 auth.crit] fatal: padding error: need 28 block 8 mod 4

Oct 23 07:28:23 server sshd[3252]: [ID 800047 auth.crit] fatal: padding error: need 28 block 8 mod 4

I have a nagios server that is monitoring those servers what can be the cause of this

merssage

Luc

lstdenis at 2007-7-7 2:00:15 > top of Java-index,Solaris Operating System,Solaris Essentials - General Technical Questions...
# 3

Your message is different, so it may be a different issue.

Nagios tries to see if ssh is up by connecting to the ssh port (22). However, it doesn't do an SSH exchange. It just connects and drops. SSH logs whenever that occurs.

You'd need to either not log it, or have an agent that was smarter about how it tested ssh availability.

--

Darren

Darren_Dunham at 2007-7-7 2:00:15 > top of Java-index,Solaris Operating System,Solaris Essentials - General Technical Questions...