Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #193500

Re: Open socket not connected to any real process

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Well, crap.  It turns out this isn't a problem.  PAM is configured for LDAP
authentication and so it opens a connection each time I log in, owned by my
sshd process, even though it's not using LDAP authentication for root.  And
the other LDAP queries I'm seeing are being sent when users authenticate
via sendmail.  Case closed!

On Wed, Mar 7, 2018 at 4:16 PM, David Parker <dparker@utica.edu> wrote:

> Hello,
>
> I have an SMTP server running Debian Wheezy (64-bit).  A few weeks ago, I
> stopped nscd on it, because it was holding a connection open to our LDAP
> server and sending a ton of unnecessary queries to it.
>
> Even though nscd is not running, I am once again seeing nscd-type queries
> on the LDAP server from this SMTP server, and a connection is open from the
> SMTP server.  But I can't seem to figure out what process is using that
> connection.  Every time I check using netstat or lsof, it just reports that
> the socket is owned by my current sshd process.
>
> An example:
>
> root@smtp:~# netstat -anp | grep 389
> tcp        0      0 <smtp-ip>:58786   <ldap-ip>:389    ESTABLISHED
> *10249/0*
>
> root@smtp:~# lsof -n -i :389
> COMMAND   PID USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
> sshd    *10249 root*    4w  IPv4 86936230      0t0  TCP
> <smtp-ip>:58786-><ldap-ip>:ldap (ESTABLISHED)
>
> root@smtp:~# ps -ef | grep 10249
> *root     10249 17111  0 15:49 ?        00:00:00 sshd: root@pts/0*
> root     10251 10249  0 15:50 pts/0    00:00:00 -bash
> root     10286 10251  0 15:54 pts/0    00:00:00 grep 10249
>
> So I log out and back in, and the PID for this socket changes to my new
> sshd process:
>
> root@smtp:~# netstat -anp | grep 389
> tcp        0      0 <smtp-ip>:58798   <ldap-ip>:389    ESTABLISHED
> *10288/0*
>
> root@smtp:~# lsof -n -i :389
> COMMAND   PID USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
> sshd    *10288 root*    4w  IPv4 86936319      0t0  TCP
> <smtp-ip>:58798-><ldap-ip>:ldap (ESTABLISHED)
>
> root@smtp:~# ps -ef | grep 10288
> *root     10288 17111  0 15:54 ?        00:00:00 sshd: root@pts/0*
> root     10290 10288  0 15:54 pts/0    00:00:00 -bash
> root     10304 10290  0 15:55 pts/0    00:00:00 grep 10288
>
> And all the while, LDAP queries continue to be sent over this connection.
> Does anyone have any idea why I can't seem to track down the real process
> which is holding this socket open?
>
> Thanks!
> Dave
>
> --
> Dave Parker '11
> Database & Systems Administrator
> Utica College
> Integrated Information Technology Services
> (315) 792-3229
> Registered Linux User #408177
>



-- 
Dave Parker '11
Database & Systems Administrator
Utica College
Integrated Information Technology Services
(315) 792-3229
Registered Linux User #408177

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Open socket not connected to any real process David Parker <dparker@utica.edu> - 2018-03-07 22:20 +0100
  Re: Open socket not connected to any real process David Parker <dparker@utica.edu> - 2018-03-07 22:50 +0100
    Re: Open socket not connected to any real process Sven Hartge <sven@svenhartge.de> - 2018-03-07 23:10 +0100
      Re: Open socket not connected to any real process Roberto C. Sánchez <roberto@debian.org> - 2018-03-08 03:10 +0100
        Re: Open socket not connected to any real process Sven Hartge <sven@svenhartge.de> - 2018-03-08 13:30 +0100

csiph-web