On Tue, 2009-01-27 at 06:35 -0500, John A. Sullivan III wrote: > On Tue, 2009-01-27 at 17:44 +1100, Declan Mullen wrote: > > > > John A. Sullivan III wrote: > > > On Mon, 2009-01-26 at 07:26 -0500, John A. Sullivan III wrote: > > > > > >> On Mon, 2009-01-26 at 06:28 -0500, John A. Sullivan III wrote: > > >> > > >>> On Mon, 2009-01-26 at 20:25 +1100, Declan Mullen wrote: > > >>> > > >>>> Hi > > >>>> > > >>>> When I ssh into my Linux server, the login succeeds but I notice that I > > >>>> get the following type of entry appended to the auth.log : > > >>>> > > >>>> Jan 26 17:10:45 maxv1 sshd[32624]: error writing /proc/self/oom_adj: > > >>>> Permission denied > > >>>> > > >>>> What are the implications of the sshd not being able to write to the > > >>>> oom_adj ? Ie Is this error significant or should I just ignore it ? > > >>>> > > >>>> The sshd's write is failing because the server I'm logging into is a > > >>>> VServer guest/virtual server, and the VServer virtualisation technology > > >>>> places restrictions on what can be written to the /proc filesystem from > > >>>> within the guest. > > >>>> > > >>>> The guest server OS is Debian Lenny and the sshd versions is > > >>>> "1:5.1p1-5". Within the sshd_config Privilege Separation is turned on. > > >>>> > > >>>> The host server's kernel is Lenny's "linux-source-2.6.26" (version > > >>>> "2.6.26-13") with Lenny's vserver patches applied from > > >>>> "linux-patch-debian-2.6.26" (version "2.6.26-13"). The host's > > >>>> util-vserver package is version "0.30.216~r2772-6". The host's > > >>>> "vserver-debiantools" package is version "0.6.3". > > >>>> > > >>> <snip> > > >>> I'm facing the same issue and would like for the guest to be able to set > > >>> oom_adj. I would imagine this is done by editing the vprocunhidefiles > > >>> file However, before doing so, I'd like to ask the list if there is a > > >>> security issue in doing so. I suppose a savvy guest could make their > > >>> system a hog - the last one to have any processes shut down in an out of > > >>> memory condition thus creating an availability problem but I wouldn't > > >>> imagine it creates a data confidentiality or integrity problem. Is this > > >>> true? Thanks - John > > >>> > > >> Oops! That's not true. OpenSSH appears to want to create this /proc > > >> entry. vprocunhide doesn't seem to solve that problem! - John > > >> > > > > > > By the way, if one wants to stop the error message, one can > > > edit /etc/init.d/ssh and comment out the calls to adjust_oom in the > > > start and restart sections of the init script - John > > > > > > > I have just noticed that in /etc/default/ssh : > > > > # OOM-killer adjustment for sshd (see > > # linux/Documentation/filesystems/proc.txt; lower values reduce likelihood > > # of being killed, while -17 means the OOM-killer will ignore sshd; set to > > # the empty string to skip adjustment) > > SSHD_OOM_ADJUST=-17 > > > > I've modified this file to set SSHD_OOM_ADJUST to a null string, and now > > sshd no longer attempts to write to oom_adj and the error messages no > > longer occur. > <snip> > Much better solution. I had read in an older post that doing so did not > work as expected. I'm glad it has been fixed and will change my > installations to this method. Thanks - John Argh! It does not appear to work on fully patched Ubuntu 8.0.4. In fact, the comment is different: # OOM-killer adjustment for sshd (see # linux/Documentation/filesystems/proc.txt; lower values reduce likelihood # of being killed, -17 = disable) SSHD_OOM_ADJUST=-17 Back to commenting out the lines in the init script :( -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan@opensourcedevel.com http://www.spiritualoutreach.com Making Christianity intelligible to secular society