Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I seem to have broken ssh on my machine!

If I run:

sudo /usr/sbin/sshd -d

I get:

debug1: sshd version OpenSSH_5.8p1 Debian-7ubuntu1
debug1: read PEM private key done: type RSA
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
debug1: private host key: #0 type 1 RSA
debug1: read PEM private key done: type DSA
debug1: Checking blacklist file /usr/share/ssh/blacklist.DSA-1024
debug1: Checking blacklist file /etc/ssh/blacklist.DSA-1024
debug1: private host key: #1 type 2 DSA
debug1: read PEM private key done: type ECDSA
debug1: Checking blacklist file /usr/share/ssh/blacklist.ECDSA-256
debug1: Checking blacklist file /etc/ssh/blacklist.ECDSA-256
debug1: private host key: #2 type 3 ECDSA
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-d'
Set /proc/self/oom_score_adj from 0 to -1000
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
debug1: Bind to port 22 on ::.
Server listening on :: port 22.

Then from another terminal:

ssh localhost

gives me:

Write failed: Broken pipe

And in the debug I get:

debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8
debug1: inetd sockets after dupping: 3, 3
Connection from ::1 port 57699
debug1: Client protocol version 2.0; client software version OpenSSH_5.8p1 Debian-7ubuntu1
debug1: match: OpenSSH_5.8p1 Debian-7ubuntu1 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.8p1 Debian-7ubuntu1
debug1: permanently_set_uid: 114/65534
debug1: list_hostkey_types: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: expecting SSH2_MSG_KEX_ECDH_INIT
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: KEX done
debug1: userauth-request for user tdiethe service ssh-connection method none
debug1: attempt 0 failures 0
debug1: PAM: initializing for "tdiethe"
debug1: userauth-request for user tdiethe service ssh-connection method publickey
debug1: attempt 1 failures 0
debug1: test whether pkalg/pkblob are acceptable
debug1: PAM: setting PAM_RHOST to "zoostorm"
debug1: PAM: setting PAM_TTY to "ssh"
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
debug1: temporarily_use_uid: 1000/0 (e=0/0)
debug1: trying public key file /home/tdiethe/.ssh/authorized_keys
debug1: Could not open authorized keys '/home/tdiethe/.ssh/authorized_keys': No such file or directory
debug1: restore_uid: 0/0
debug1: temporarily_use_uid: 1000/0 (e=0/0)
debug1: trying public key file /home/tdiethe/.ssh/authorized_keys2
debug1: Could not open authorized keys '/home/tdiethe/.ssh/authorized_keys2': No such file or directory
debug1: restore_uid: 0/0
Failed publickey for tdiethe from ::1 port 57699 ssh2
debug1: userauth-request for user tdiethe service ssh-connection method password
debug1: attempt 2 failures 1
debug1: PAM: password authentication accepted for tdiethe
debug1: do_pam_account: called
Accepted password for tdiethe from ::1 port 57699 ssh2
debug1: monitor_child_preauth: tdiethe has been authenticated by privileged process
debug1: PAM: establishing credentials
User child is on pid 16189
debug1: SELinux support disabled
debug1: PAM: establishing credentials
debug1: permanently_set_uid: 1000/0
setresuid 1000: Resource temporarily unavailable
debug1: do_cleanup
debug1: do_cleanup
debug1: PAM: cleanup
debug1: PAM: closing session
debug1: PAM: deleting credentials

It seems to be the

setresuid 1000: Resource temporarily unavailable

that is causing the problem - any idea what this causes this?

share|improve this question

1 Answer 1

up vote 2 down vote accepted
setresuid 1000: Resource temporarily unavailable

This error means that the SSH server failed to start a shell as your user, because there are already too many processes running as your user.

If you can get into the system somehow, check if there are runaway processes and do some killing.

If you only see normal usage, the maximum number of processes per user is too low for you. The bash/zsh command ulimit -u will show you the current value of the limit. Increase the nproc limit in /etc/security/limits.conf, e.g.

tdiethe hard nproc 200
share|improve this answer
    
ulimit -u gives me 63754 ... I've done the nproc as you suggest and closed everything I could but still no luck. As a bit of history I had installed bastille. I've just done sudo RevertBastille which has fixed it, but I'm not sure why! –  tdc Mar 27 '12 at 21:09
    
@tdc If it wasn't for the nproc limit, my next guess would have been some hardening framework that imposed a similar restriction. Good that you could solve your problem. –  Gilles Mar 27 '12 at 22:02
    
Just for the records, in case someone else comes across this post, I was having a similar problem. As I have to run a large number of processes under my user account, I had modified my limits using ulimit in the bash profile. These new limits were somehow clashing against the limits set in the /etc/security/limits.conf file. I then added an entry in the .conf file matching the limits I had put in the profile for my user. At that point, I was able to log in without the "broken pipe" error. I guess I can remove the ulimit entry from my profile now. –  user869197 Jun 19 '13 at 9:42
    
@user869197 From your .profile, you can only lower the limits. (I'm talking about hard limits; the default soft limit is set to the hard limit, so it's the hard limit you need to raise.) Only root can raise the limits, so if the default limits are too low, you need to modify the system-wide setting. Once you've done that, anything you do in .profile can only lower the limit, so it's indeed useless. –  Gilles Jun 19 '13 at 12:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.