Strange Message on SSH Logout

[rusty]

Anyone have any ideas on why I would see the following "error" everytime I logout of an ssh session on one of my machines?

[caliban:~] rusty% logout
Bus error
Connection to caliban closed.
[puck:~] rusty%


Of possible relation, on ssh to this machine, these lines appear in the syslog:

Jan 22 10:35:41 caliban sshd[1814]: lastlog_perform_login: Couldn't stat /var/log/lastlog: No such file or directory
Jan 22 10:35:41 caliban sshd[1814]: lastlog_openseek: /var/log/lastlog is not a file or directory!
Jan 22 10:35:41 caliban sshd[1814]: lastlog_perform_login: Couldn't stat /var/log/lastlog: No such file or directory
Jan 22 10:35:41 caliban sshd[1814]: lastlog_openseek: /var/log/lastlog is not a file or directory!


And possibly more important, this line appears in the syslog on logout:

Jan 22 10:35:46 caliban WindowServer[1418]: _CGXGetDisplayShmem: Unauthorized user


Anyone know what might be happening here?

Thanks
Rusty

[Novajo]

It is not the lastlog error. I had that error too, and I am quite sure it is very minor (even though I do not understand it). You can type man lastlog to get information about that file. My ssh does not crash even though I have the same lastlog error in the logs.

[mervTormel]

as for the lastlog errors, i think this might squelch those...

%sudo touch /var/log/lastlog

the errors are just complaining that the file doesn't exit, and it won't create it for you, but i could be wrong.

re: bus error

i think i remember seeing some sort of bug about running the tcsh logout script when the shell exits.

is this code in your logout script in /usr/share/init/tcsh/logout ?


if (! $?TERM_PROGRAM) then
# Don't run these commands if the shell is launched by Terminal,
# even if it's a login shell.

if ({ (klist -s >& /dev/null) }) kdestroy

endif

[rusty]

as for the lastlog errors, i think this might squelch those...

%sudo touch /var/log/lastlog

the errors are just complaining that the file doesn't exit, and it won't create it for you, but i could be wrong.


Did the touch lastlog thing, and now a new message appears in syslog upon login:

Jan 22 16:08:08 caliban sshd[2029]: lastlog_get_entry: Error reading from /var/log/lastlog: Device not configured


Any insight on what's happening now?


is this code in your logout script in /usr/share/init/tcsh/logout ?


Yes. The code you quote is there. In fact here is the entire script:

##
# LOGOUT FILE
#
# Wilfredo Sanchez Jr. | tritan@mit.edu
# Dec. 5, 1990
#
# MIT Project Athena
##

if (! $?TERM_PROGRAM) then
# Don't run these commands if the shell is launched by Terminal,
# even if it's a login shell.

if ({ (klist -s >& /dev/null) }) kdestroy

endif

##
# Read user's logout
##
if (-r "${tcsh_initdir}/logout.mine") then
source "${tcsh_initdir}/logout.mine"
endif


Any advice on what specifically might be inducing the "bus error"?


Thanks
Rusty

[mervTormel]

are you using vanilla ssh/sshd or an installed port of the package?

can we see your ssh command? anonomized, of course.


as for lastlog, i know finger uses it, so try to finger yourself and see what happens. perhaps fingering yourself will prime the file.

but first, do a ls -l /var/log/lastlog

i think it needs to be -rw-r--r--

but i'd like to see the 'ls -l' results before you finger


-b

[rusty]

are you using vanilla ssh/sshd or an installed port of the package?


Haven't touched ssh/sshd. It's whatever is installed as part of 10.1.2 (5P48).

but first, do a ls -l /var/log/lastlog

i think it needs to be -rw-r--r--


Yes it is indeed u+rw,go+r:

-rw-r--r-- 1 root wheel 14056 Jan 22 19:15 lastlog


And finger seems to work as expected.


Rusty

[mervTormel]

hmmm, curious.

have you mucked around in xdm, perchance?

[rusty]

Originally posted by babaluguts
hmmm, curious.

have you mucked around in xdm, perchance?

No, and by the way, I just tested a terminal session opened on the machine in question locally (no ssh). Issuing a "logout" in that session will produce a "bus error" as well.



Rusty

[mervTormel]

i knew i had read 'ssh' and 'logout' and 'bus error' somewhere. that's the great thing about these forums.

so, at...

http://www.macintouch.net/mosxreaderreports66.html

-----

Date: Sun, 18 Nov 2001 12:12:46 +0100
From: Loek Jehee
Subject: SSH - tcsh - klist bug in 10.1.1.

There is a bug in 10.1.1. that causes the Terminal to logout disgracefully after having logged in (as superuser or other ordinary user) to your own machine using SSH. A "bus error" is the result.

The problem seems to be caused by "klist" that is called by "tcsh" on logout. This is a kerberos program and it calls CCacheServer. Klist crashes with a bus error.

The problems will go away by commenting out (i.e. putting a # in front of it) the following line in the file /usr/share/init/tcsh/logout :


if ({ (klist -s >& /dev/null) }) kdestroy

You must do this as admin user using a plain text editor like joe or vi or emacs.

Loek

-----

and Craig and Robg, isn't this Loek, whom we met at macworld SF 2002? i believe it is. huzzah!

[rusty]

You beat me to it, but we were on the same track (http://groups.google.com/groups?hl=en&threadm=vux3d1f5x46.fsf%40lonestar.gsfc.nasa.gov&rnum=1&prev=/groups%3Fq%3Dmac%2BOS%2BX%2Bbus%2Berror%2Blogout%26hl%3Den%26selm%3Dvux3d1f5x46.fsf%2540lonestar.gsfc.nasa.gov%26rnum%3D 1):


Now I'm going to try to track down the deal with those lastlog messages. I tested on another OS X machine and see the same lastlog messages there.


Rusty