Hung OpenSSH 3.5p1 sessions/connections

Hi all.

I wrote earlier about a problem with hung ssh connections, I got a response telling me to run pfiles and pmap -x on the hanging pid to figure out what was holding the ssh connection up. I did this but I can't make anything of the stuff I got back.

Can someone with a bit more insight tell me what these outputs might mean?

---8<---

ROOT# pfiles 22235
22235: /usr/local/sbin/sshd
  Current rlimit: 256 file descriptors

   0: S_IFCHR mode:0666 dev:32,0 ino:447773 uid:0 gid:3 rdev:13,2
      O_RDWR|O_LARGEFILE
   1: S_IFCHR mode:0666 dev:32,0 ino:447773 uid:0 gid:3 rdev:13,2
      O_RDWR|O_LARGEFILE
   2: S_IFCHR mode:0666 dev:32,0 ino:447773 uid:0 gid:3 rdev:13,2
      O_RDWR|O_LARGEFILE
   3: S_IFCHR mode:0666 dev:32,0 ino:447774 uid:0 gid:3 rdev:13,12
      O_RDWR|O_LARGEFILE
   4: S_IFSOCK mode:0666 dev:189,0 ino:8504 uid:0 gid:0 size:0
      O_RDWR|O_NONBLOCK
   5: S_IFCHR mode:0666 dev:32,0 ino:447774 uid:0 gid:3 rdev:13,12
      O_RDWR|O_LARGEFILE
   6: S_IFIFO mode:0000 dev:190,0 ino:4703045 uid:123 gid:110 size:0
      O_RDWR|O_NONBLOCK FD_CLOEXEC
   7: S_IFIFO mode:0000 dev:190,0 ino:4703045 uid:123 gid:110 size:0
      O_RDWR|O_NONBLOCK FD_CLOEXEC
   8: S_IFCHR mode:0666 dev:32,0 ino:447774 uid:0 gid:3 rdev:13,12
      O_RDWR|O_LARGEFILE
   9: S_IFSOCK mode:0666 dev:189,0 ino:29888 uid:0 gid:0 size:0
      O_RDWR FD_CLOEXEC
  11: S_IFCHR mode:0000 dev:32,0 ino:21824 uid:0 gid:0 rdev:23,7
      O_RDWR|O_NONBLOCK|O_LARGEFILE

---8<---

ROOT# pmap -x 22235
22235: /usr/local/sbin/sshd

Address   Kbytes Resident Shared Private Permissions       Mapped File
00010000     880     680     648      32 read/exec         sshd
000FA000      48      48      32      16 read/write/exec   sshd
00106000     152     104       -     104 read/write/exec    [ heap ]
EF200000    1280       8       -       8 read/write/shared  [ anon ]
EF350000      80      56      48       8 read/exec         pam_unix.so.1
EF372000      24      24      16       8 read/write/exec   pam_unix.so.1
EF380000    1280       -       -       - read/write/shared  [ anon ]
EF4F0000      56      56      56       - read/exec         libresolv.so.2
EF50C000      16      16       -      16 read/write/exec   libresolv.so.2
EF510000       8       8       -       8 read/write/exec    [ anon ]
Do you need help?
In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software:
Learn more about Pantek's Technical Support offerings
Place an order for 24/7/365 Technical Support here
Learn more about Pantek, who we are, and what we do
Chat with a Live Operator
Related securityfocus.com Links
bugtraq
certification
focus-bsd
focus-ids
focus-ih
focus-linux
focus-ms
focus-sun
focus-unix-other
focus-virus
forensics
incidents
libnet
linux-secnews
ms-secnews
pen-test
secpapers
secprog
sectools
secureshell
security-basics
securityjobs
sf-news
vuln-dev
webappsec
Request more information about Pantek
EF520000       8       8       8       - read/exec         nss_dns.so.1
EF530000       8       8       8       - read/write/exec   nss_dns.so.1
EF560000      16      16      16       - read/exec         nss_files.so.1
EF572000       8       8       -       8 read/write/exec   nss_files.so.1
EF580000     600     544     520      24 read/exec         libc.so.1
EF624000      32      32       8      24 read/write/exec   libc.so.1
EF62C000       8       8       8       - read/write/exec    [ anon ]
EF640000       8       8       -       8 read/write/exec    [ anon ]
EF650000      16      16      16       - read/exec         libc_psr.so.1
EF660000      16      16      16       - read/exec         libmp.so.2
EF672000       8       8       -       8 read/write/exec   libmp.so.2
EF680000     480     336     328       8 read/exec         libnsl.so.1
EF706000      40      40       8      32 read/write/exec   libnsl.so.1
EF710000      24       8       -       8 read/write/exec    [ anon ]
EF720000      32      32      32       - read/exec         libsocket.so.1
EF736000       8       8       -       8 read/write/exec   libsocket.so.1
EF738000       8       8       -       8 read/write/exec    [ anon ]
EF740000      56      24       8      16 read/exec         libz.so.1.1.4
EF75C000      16      16       -      16 read/write/exec   libz.so.1.1.4
EF780000      24      24      24       - read/exec         libpam.so.1
EF794000      16      16      16       - read/write/exec   libpam.so.1
EF7A0000       8       8       -       8 read/write/exec    [ anon ]
EF7B0000       8       8       8       - read/exec         libdl.so.1
EF7C0000     144     144     144       - read/exec         ld.so.1
EF7F2000      16      16       -      16 read/write/exec   ld.so.1
Do you need more help?
In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software:
Learn more about Pantek's Technical Support offerings
Place an order for 24/7/365 Technical Support here
Learn more about Pantek, who we are, and what we do
Chat with a Live Operator
Related securityfocus.com Links
bugtraq
certification
focus-bsd
focus-ids
focus-ih
focus-linux
focus-ms
focus-sun
focus-unix-other
focus-virus
forensics
incidents
libnet
linux-secnews
ms-secnews
pen-test
secpapers
secprog
sectools
secureshell
security-basics
securityjobs
sf-news
vuln-dev
webappsec
Request more information about Pantek
EFFF8000      32      32       -      32 read/write         [ stack ]


--------  ------  ------  ------  ------


total Kb    5464    2392    1968     424

---8<---

Can we help you?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

I'm thinking it might be some problem with PAM... But that's just an unqualified guess.

-- 
Mattias Larsson - sparhawk@beyond.nu - ICQ 4877007
http://www.beyond.nu - 
Sparhawk(at)irc.beyond.nu