Amanda-Users

Re: Attempt to contact amanda gives sshd error -- dont know why sshd is involved!

2006-03-30 16:26:31
Subject: Re: Attempt to contact amanda gives sshd error -- dont know why sshd is involved!
From: Michael Loftis <mloftis AT wgops DOT com>
To: Kevin Till <kevin.till AT zmanda DOT com>, "Lengyel, Florian" <FLengyel AT gc.cuny DOT edu>
Date: Thu, 30 Mar 2006 14:21:07 -0700


--On March 30, 2006 1:01:29 PM -0800 Kevin Till <kevin.till AT zmanda DOT com> wrote:


the "Did not receive identification string from::ffff:10.10.32.247"
should not have anything to do with Amanda. Seems to me someone try to
login as amanda to that machine.

It doesn't. This actually happens when someone or something opens the SSH port and never does anything and closes it. Monitoring apps do this a lot looking for the SSH banner.

'amanda' in the SSH lines is your host's name. The START lines indicate xinetd is starting amandad, so you should look in /tmp/amanda/amandad*.debug and /tmp/amanda/amcheck*.debug. They're date+time stamped files.

Couple things to check, is amandad started correctly on the client?
1) /etc/init.d/xinetd restart and see if there is any error on
/var/log/messages.

2) any error in /tmp/amanda/amcheck*.debug?

Thanks!

--Kevin Till
Zmanda



amcheck -m Daily

/var/log/secure gives me this:


[root@amanda log]# tail secure
Mar 30 13:15:03 amanda sshd[19449]: Did not receive identification
string from::ffff:10.10.32.247
Mar 30 13:20:03 amanda sshd[19495]: Did not receive identification
string from::ffff:10.10.32.247
Mar 30 13:25:03 amanda sshd[19538]: Did not receive identification
string from::ffff:10.10.32.247
Mar 30 13:30:04 amanda sshd[19584]: Did not receive identification
string from::ffff:10.10.32.247
Mar 30 13:32:24 amanda xinetd[2244]: START: amanda pid=19702
from=10.10.32.250
Mar 30 13:32:24 amanda xinetd[2244]: START: amanda pid=19705
from=10.10.32.250
Mar 30 13:35:04 amanda sshd[20042]: Did not receive identification
string from::ffff:10.10.32.247
Mar 30 13:40:05 amanda sshd[20088]: Did not receive identification
string from::ffff:10.10.32.247
Mar 30 13:45:05 amanda sshd[20131]: Did not receive identification
string from::ffff:10.10.32.247
[root@amanda log]#





--
Thank you!
Kevin Till

Amanda documentation: http://wiki.zmanda.com
Amanda forums:        http://forums.zmanda.com




--
"Genius might be described as a supreme capacity for getting its possessors
into trouble of all kinds."
-- Samuel Butler