search

droberson / ssh-honeypot

Fake sshd that logs ip addresses, usernames, and passwords.
MIT License
627 stars 242 forks source link

zombie child processes #1

Closed sibrat closed 7 years ago

sibrat commented 7 years ago

Zombie created with each authentication request. i think something like this http://stackoverflow.com/questions/17015830/how-can-i-prevent-zombie-child-processes can help you solve problem

droberson commented 7 years ago

Should be fixed now. I simply ignored SIGCHLD signals. Thank you for pointing this out!

sibrat commented 7 years ago

nope. I still getting horde of zombies :) [root@home bin]# ./ssh-honeypot -r fake_id_rsa -b 192.168.1.10 [Fri Dec 30 11:38:50 2016] ssh-honeypot 0.0.3 by Daniel Roberson started on port 22. PID 30392 [Fri Dec 30 11:39:37 2016] 5.9.121.5 Error exchanging keys: [Fri Dec 30 11:40:31 2016] 144.76.41.215 root admin [Fri Dec 30 11:41:04 2016] 5.9.117.108 root admin [Fri Dec 30 11:43:36 2016] 109.236.91.85 root admin [root@home bin]# ps aux | grep 'Z' USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 30395 0.0 0.0 0 0 pts/1 Z+ 11:39 0:00 [ssh-honeypot] root 30773 0.0 0.0 0 0 pts/1 Z+ 11:40 0:00 [ssh-honeypot] root 31202 0.0 0.0 0 0 pts/1 Z+ 11:40 0:00 [ssh-honeypot] root 31207 0.2 0.0 0 0 pts/1 Z+ 11:43 0:00 [ssh-honeypot]

droberson commented 7 years ago

on version 0.0.3? what type of system are you running this on? I confirmed the bug in 0.0.2, applied the fix, and it is no longer leaving zombies hanging on 0.0.3

sibrat commented 7 years ago

CentOs 3.10.0-514.2.2.el7.x86_64. Oh, i see problem: you add code in "if (daemonize == 1) {} ". But i don't daemonize it :)

droberson commented 7 years ago

Doh! Should be good now.