droberson/ssh-honeypot

zombie child processes

sibrat opened this issue · 5 comments

sibrat commented

Zombie created with each authentication request.
i think something like this http://stackoverflow.com/questions/17015830/how-can-i-prevent-zombie-child-processes can help you solve problem

droberson commented

Should be fixed now. I simply ignored SIGCHLD signals. Thank you for pointing this out!

sibrat commented

nope. I still getting horde of zombies :)
[root@home bin]# ./ssh-honeypot -r fake_id_rsa -b 192.168.1.10
[Fri Dec 30 11:38:50 2016] ssh-honeypot 0.0.3 by Daniel Roberson started on port 22. PID 30392
[Fri Dec 30 11:39:37 2016] 5.9.121.5 Error exchanging keys:
[Fri Dec 30 11:40:31 2016] 144.76.41.215 root admin
[Fri Dec 30 11:41:04 2016] 5.9.117.108 root admin
[Fri Dec 30 11:43:36 2016] 109.236.91.85 root admin
[root@home bin]# ps aux | grep 'Z'
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 30395 0.0 0.0 0 0 pts/1 Z+ 11:39 0:00 [ssh-honeypot]
root 30773 0.0 0.0 0 0 pts/1 Z+ 11:40 0:00 [ssh-honeypot]
root 31202 0.0 0.0 0 0 pts/1 Z+ 11:40 0:00 [ssh-honeypot]
root 31207 0.2 0.0 0 0 pts/1 Z+ 11:43 0:00 [ssh-honeypot]

droberson commented

on version 0.0.3? what type of system are you running this on? I confirmed the bug in 0.0.2, applied the fix, and it is no longer leaving zombies hanging on 0.0.3

sibrat commented

CentOs 3.10.0-514.2.2.el7.x86_64. Oh, i see problem: you add code in "if (daemonize == 1) {}
". But i don't daemonize it :)

droberson commented

Doh! Should be good now.