Memory Usage with openSSH 4.0

[Darren Tucker]

Stephen John Smoogen wrote:
> On 4/25/06, J D <parkingtree at yahoo.com> wrote:
>> I have friends running sshd on their emebedded ppc
>> linux systems at two universities. Normally sshd takes
>> about 3M of memory and they have about 16M freemem
>> showed in /proc/meminfo. But occationally (every 1 or
>> 2 weeks) they see free memory goes down really fast
>> and they lose 10M in 1 minute. If they disable sshd by
>> blocking the port access, this does not happen any
>> more.
>>
>> The device is not behind any firewall and sshd version
>> is 4.0.
>>
>> I've done a lot search on the web and have not found
>> any report of similar issues. I was hoping experts on
>> this mailing list can help shed some light on this
>> problem. Thanks.
> 
> That is an old version.. so I am not sure much help here.. but there
> needs to be some info on the type of configuration, also what is the
> OS, etc. My off-the-wall guess is that the box gets one of the weekly
> very large dictionary attack during those times and may not be able to
> log as quickly as it wants to (depending on how the embedded libc is
> dealing with logging).

It could also be related by the client-side behaviour.  Since sshd forks 
immediately after accepting the connection, if the client(s) makes a 
bunch of connections in parallel then you will probably see a spike in 
memory usage.

If that's the cause you can mitigate it with MaxStartups in sshd_config.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
     Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.