I normally ssh into my mailserver from another system with a GUI. This afternoon, I noticed the connection had closed, and when I tried to ssh back in I got a connection refused on Port 22 message. So I had to plug in a keyboard and monitor and log directly onto the mail machine (Sarge setup). I eventually tried ssh restart and it still refused connections. So I poked thru the auth.log to find 'sshd FAILED daemon FATAL' and proceeded to Google that error message. I came across a post from someone who found /dev/null had been changed into a regular file, and as soon as he repaired it and restarted ssh everything worked again. Sure enough /dev/null was a regular file! A growing file. Also managed to Google mknod -m 666 /dev/null c 1 3 as how to remake the /dev/null, but first I renamed the regular file null instead of deleting it. The remake of /dev/null, a restart off ssh, and a successful log entry and all is well again. What wrecked my /dev/null? Googling found odd problems like this from gcc, kconfig, and possibly webmin, none of which are running. Checking the renamed file I found this: Code: DCC -> check failed: Died at /usr/share/perl5/Mail/SpamAssassin/Dns.pm line 806. Too late into the day to keep checking, but I will have to keep my eye on this. Just wondered if anyone has seen this problem? (googled already and found ONE but I don't read or speak German)
I think you should check if someone broke into your system: http://www.howtoforge.com/faq/1_38_en.html
Nope she's clean. I think I may have done it, I was trying to make a hidden directory in someone's maildir the day before, and tried to make a sym link to /dev/null. Didn't work, so I removed the link, which may have mucked up /dev/null.... I was trying to see if it was possible to make a folder that showed in SA that you could direct mail to that automatically deleted everything sent to it..... it worked once, then never again. I guess now I know why....
