Server crashed (after updating to 3.8?) unable to restart, unable to chroot

Oni-Shadow · June 2, 2020, 9:37pm

Message template

Bonjour,
J’avais une instance YNH qui fonctionnait parfaitement, depuis 3ans, sur un macbookair.
Depuis hier (1er Juin 2020) 6h52, mon serveur est complètement parti en vrille et je ne sais pas quoi faire…

My YunoHost server

Hardware: Macbook air (intel)
YunoHost version: 3.8
I have access to my server : physical access, but it will not boot
Are you in a special context or did you perform some particular tweaking on your YunoHost instance ? : yes
If yes, please explain: docker with home assistant / node red / deconz

Description of my issue

depuis Hier donc, plus aucun service ne fonctionnait, je tente bêtement un reboot et là impossible de rebooter, grub ne vois plus de partition sur qui booter (instalation sur table GPT avec MBR hibride)

J’ai tenté de passer en full UEFI et installé une partition de 6 Gio de lubuntu "pour voir"ok, je peux demarer.
j’ai voulu passer debian en UEFI et là, au moment de faire un chroot sur ma partition / (yunohost) impossible car pas de /bin/bash.

En y regardant de plus prêt enfait, il manaue beaucoup de donnés sur le / j’ai l’impression. Par exemple /etc ne contient pas de fichier fstab.

J’ai accès à tous les logs par contre et on voit clairement qu’après 6h52 (date de dernière modif de /bin et /lib, il y a plein de message d’erreur avec des /usr/share/dbus-1/system.conf manquant, puis des unable to find user root.

mon instance etait derrière un routeur avec le port 22, 80 et 443 de redirigé vers lui,
les app

Nextcloud
freshrss
opensondage
ghost in the shel
pixelfed
plume
plus docker avec Home Assistant, Node Red, deconz (port 8123, 1880, 8080) accessible qu’en LAN. (installé par ce que HA nécessite une version de python incompatible avec la debian installée)

Je me sers énormément de mon instance et suis assez désesperé… une partie de mon travail se synchronise via nextcloud et les lumière de ma maison via homeassistant ; que puis-je encore sauver ?

Aleks · June 2, 2020, 10:35pm

Uuuuh wokay ben ça a l’air assez particulier comme soucis … est-ce que tu saurais dire ce qui s’est passé autour de 6h52 …?

Oni-Shadow · June 3, 2020, 5:47am

Hello,
Merci de t’interresser a mon probleme. Hormis la partie domotic avec docker, je n’ ai rien fait qui sorte des sentiers battus, les app etaient globalement de bonne qualite et je n’ai jamais eu de soucis trop compliqu’e `a resoudre

(le seul probleme que j’ ai eu est un changement ip fixe locale il y a 4 mois, suite au changement de cable eternet, donc le routeur ne trouvait plus l’ ordinateur en suivant les regles nat, mais je m’en suis sorti)

Bref, je ne sais pas ce qui a pu se passer, mais je te mets les logs (d’ abord YNH, puis syslog)

backup:/mnt/var/log$ sudo cat yunohost/yunohost-cli.log
2020-06-01 06:25:04,030 DEBUG    moulinette.actionsmap __init__ - loading actions map namespace 'yunohost'
2020-06-01 06:25:04,065 DEBUG    moulinette.actionsmap __init__ - extra parameter classes loaded: ['comment', 'ask', 'password', 'required', 'pattern']
2020-06-01 06:25:04,065 DEBUG    moulinette.interface __init__ - initializing base actions map parser for cli
2020-06-01 06:25:04,068 DEBUG    moulinette.interface __init__ - registering new callback action 'yunohost.utils.packages.ynh_packages_version' to ['-v', '--version']
2020-06-01 06:25:04,227 DEBUG    moulinette.core acquire - acquiring lock...
2020-06-01 06:25:04,281 DEBUG    moulinette.core acquire - lock has been acquired
2020-06-01 06:25:04,365 DEBUG    moulinette.actionsmap process - loading python module yunohost.domain took 0.084s
2020-06-01 06:25:04,366 INFO     moulinette.actionsmap process - processing action [22011.1]: yunohost.domain.cert-renew with args={'no_checks': False, 'force': False, 'domain_list': [], 'staging': False, 'email': True}
2020-06-01 06:25:04,405 DEBUG    moulinette.authenticator.ldap __init__ - initialize authenticator 'as-root' with: uri='ldapi://%2Fvar%2Frun%2Fslapd%2Fldapi', base_dn='dc=yunohost,dc=org', user_rdn='gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth'
2020-06-01 06:25:05,209 DEBUG    moulinette.actionsmap process - action [22011.1] executed in 0.842s
2020-06-01 06:25:05,209 DEBUG    moulinette.core release - lock has been released
2020-06-01 06:38:48,579 DEBUG    moulinette.actionsmap __init__ - loading actions map namespace 'yunohost'
2020-06-01 06:38:48,615 DEBUG    moulinette.actionsmap __init__ - extra parameter classes loaded: ['comment', 'ask', 'password', 'required', 'pattern']
2020-06-01 06:38:48,615 DEBUG    moulinette.interface __init__ - initializing base actions map parser for cli
2020-06-01 06:38:48,618 DEBUG    moulinette.interface __init__ - registering new callback action 'yunohost.utils.packages.ynh_packages_version' to ['-v', '--version']
2020-06-01 06:38:48,775 DEBUG    moulinette.core acquire - acquiring lock...
2020-06-01 06:38:48,826 DEBUG    moulinette.core acquire - lock has been acquired
2020-06-01 06:38:48,916 DEBUG    moulinette.actionsmap process - loading python module yunohost.tools took 0.089s
2020-06-01 06:38:48,916 INFO     moulinette.actionsmap process - processing action [23121.1]: yunohost.tools.update with args={'apps': True, 'system': False}
2020-06-01 06:38:48,919 INFO     yunohost.app _update_apps_catalog - [23121.1] Mise à jour du catalogue d’applications…
2020-06-01 06:38:49,918 DEBUG    requests.packages.urllib3.connectionpool _new_conn - Starting new HTTPS connection (1): app.yunohost.org
2020-06-01 06:38:50,023 DEBUG    requests.packages.urllib3.connectionpool _make_request - https://app.yunohost.org:443 "GET /default/v2/apps.json HTTP/1.1" 200 598166
2020-06-01 06:38:50,405 SUCCESS  yunohost.app success - [23121.1] Le catalogue des applications a été mis à jour !
2020-06-01 06:38:50,968 DEBUG    moulinette.actionsmap process - action [23121.1] executed in 2.052s
2020-06-01 06:38:50,968 DEBUG    moulinette.core release - lock has been released

les log var/log/syslog

Aleks · June 3, 2020, 12:22pm

Hmmbeennn jusque là rien d’anormal … enfin sauf à partir de 6h52 où il commence à dire que pleins de fichier n’existe pas …

Mais du coup je réitère ma question: est-ce que juste avant 6h52 tu as fait un truc particulier, ou bien est-ce que c’est survenu “tout seul” … (ce qui est possible)

Aleks · June 3, 2020, 12:26pm

Seconde idée : le problème semble survenir juste après le monthly cronjob (tâche automatique à faire tous les mois)

Est-ce que si tu as encore les fichiers dedans, tu peux faire un

ls /etc/cron.monthly

Oni-Shadow · June 3, 2020, 4:34pm

Non je n’ ai rien fait de particulier `a cette heure, je prenais mon petit dej…

backup:/mnt/etc/cron.monthly$ ls -la
total 16
drwxr-xr-x   2 root root  4096 juin   1 06:52 .
drwxr-xr-x 114 root root 12288 juin   2 22:22 ..
lrwxrwxrwx   1 root root    51 mai    4 16:52 YNH_backup -> /media/Data/AppData/Serveurs/backup.sh

Le fichier a disparu.

Oni-Shadow · June 3, 2020, 4:40pm

mais, le fichier est sur un dossier qui est en syncro avec Nextcloud sur un de mes ordi, donc en voici une copie :

#!/bin/bash

pathToArchive = "/media/Data/AppData/Serveurs/yunohost_backups"

# delete YNH backup file older than 40 days
find $pathToArchive -mtime +40 -type f -delete

# new backup
yunohost backup create

# copy on hard drive docker config
rsync -a /opt/Docker/ /media/Data/AppData/Serveurs/Docker/

il faut que j’épluche, mais visiblement sur le HDD connecté (monté sur /media/Data), des fichiers ont également disparus

ljf · June 3, 2020, 5:32pm

A mon avis tu devrais lancer un test de ton disque dur avec smartmontools . Peut être est-il en fin de vie ?
HDD ou SSD ?

SI tu as des sauvegardes récentes et que le disque semble ok, tu peux tenter une réinstallation. Sinon tu devrais arrêter ton serveur et tenter une récupération des données supprimée avec des outils de recovery mais ce sera pas idéal et très incomplet.

Aleks · June 3, 2020, 5:33pm

Cette ligne a l’air quand même vachement dangereuse … Perso je sais pas exactement ce qu’il y a comme contenu dans le dossier $pathToArchive, mais dans l’éventualité où il y a des liens symbolique (vers genre … /) ça peut supprimer tout un tas de truc (enfin ça dépends du comportement de find par rapport aux liens symbolique)

(Ironiquement c’est censé être un script pour faire des backups )

ljf · June 3, 2020, 5:34pm

Je me suis posé la même question…

Oni-Shadow · June 3, 2020, 5:34pm

Je regarde un peu les log et je vois

cat auth.log
Jun  1 06:25:05 oslight CRON[21812]: pam_unix(cron:session): session closed for user root
Jun  1 06:28:04 oslight sshd[22241]: Connection from 37.49.226.32 port 51044 on 192.168.1.251 port 22
Jun  1 06:28:04 oslight sshd[22241]: Did not receive identification string from 37.49.226.32 port 51044
Jun  1 06:28:08 oslight sshd[22246]: Connection from 37.49.226.32 port 59234 on 192.168.1.251 port 22
Jun  1 06:28:08 oslight sshd[22246]: Unable to negotiate with 37.49.226.32 port 59234: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Jun  1 06:28:13 oslight sshd[22248]: Connection from 37.49.226.32 port 40550 on 192.168.1.251 port 22
Jun  1 06:28:13 oslight sshd[22248]: Unable to negotiate with 37.49.226.32 port 40550: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Jun  1 06:28:17 oslight sshd[22251]: Connection from 37.49.226.32 port 50118 on 192.168.1.251 port 22
Jun  1 06:28:17 oslight sshd[22251]: Unable to negotiate with 37.49.226.32 port 50118: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Jun  1 06:28:22 oslight sshd[22287]: Connection from 37.49.226.32 port 59682 on 192.168.1.251 port 22
Jun  1 06:28:22 oslight sshd[22287]: Unable to negotiate with 37.49.226.32 port 59682: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Jun  1 06:28:26 oslight sshd[22291]: Connection from 37.49.226.32 port 41036 on 192.168.1.251 port 22
Jun  1 06:28:26 oslight sshd[22291]: Unable to negotiate with 37.49.226.32 port 41036: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Jun  1 06:28:30 oslight sshd[22294]: Connection from 37.49.226.32 port 50584 on 192.168.1.251 port 22
Jun  1 06:28:30 oslight sshd[22294]: Unable to negotiate with 37.49.226.32 port 50584: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Jun  1 06:28:34 oslight sshd[22296]: Connection from 37.49.226.32 port 60258 on 192.168.1.251 port 22
Jun  1 06:28:34 oslight sshd[22296]: Unable to negotiate with 37.49.226.32 port 60258: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Jun  1 06:28:38 oslight sshd[22298]: Connection from 37.49.226.32 port 41492 on 192.168.1.251 port 22
Jun  1 06:28:38 oslight sshd[22298]: Unable to negotiate with 37.49.226.32 port 41492: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Jun  1 06:28:57 oslight sshd[22337]: Connection from 37.49.226.32 port 41956 on 192.168.1.251 port 22
Jun  1 06:28:57 oslight sshd[22337]: Unable to negotiate with 37.49.226.32 port 41956: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Jun  1 06:30:01 oslight CRON[22415]: pam_unix(cron:session): session opened for user nextcloud by (uid=0)
Jun  1 06:30:01 oslight CRON[22416]: pam_unix(cron:session): session opened for user freshrss by (uid=0)
Jun  1 06:30:01 oslight CRON[22416]: pam_unix(cron:session): session closed for user freshrss
Jun  1 06:30:02 oslight sshd[22430]: Connection from 37.49.226.32 port 44272 on 192.168.1.251 port 22
Jun  1 06:30:02 oslight sshd[22430]: Unable to negotiate with 37.49.226.32 port 44272: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Jun  1 06:30:03 oslight CRON[22415]: pam_unix(cron:session): session closed for user nextcloud
Jun  1 06:30:04 oslight sshd[22433]: Connection from 37.49.226.32 port 34678 on 192.168.1.251 port 22
Jun  1 06:30:04 oslight sshd[22433]: Unable to negotiate with 37.49.226.32 port 34678: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Jun  1 06:30:10 oslight sshd[22437]: Connection from 37.49.226.32 port 53770 on 192.168.1.251 port 22
Jun  1 06:30:10 oslight sshd[22437]: Unable to negotiate with 37.49.226.32 port 53770: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Jun  1 06:30:14 oslight sshd[22440]: Connection from 37.49.226.32 port 35122 on 192.168.1.251 port 22
Jun  1 06:30:14 oslight sshd[22440]: Unable to negotiate with 37.49.226.32 port 35122: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Jun  1 06:30:20 oslight sshd[22442]: Connection from 37.49.226.32 port 44700 on 192.168.1.251 port 22
Jun  1 06:30:20 oslight sshd[22442]: Unable to negotiate with 37.49.226.32 port 44700: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Jun  1 06:30:23 oslight sshd[22477]: Connection from 37.49.226.32 port 54252 on 192.168.1.251 port 22
Jun  1 06:30:23 oslight sshd[22477]: Unable to negotiate with 37.49.226.32 port 54252: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Jun  1 06:30:29 oslight sshd[22479]: Connection from 37.49.226.32 port 35580 on 192.168.1.251 port 22
Jun  1 06:30:29 oslight sshd[22479]: Unable to negotiate with 37.49.226.32 port 35580: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Jun  1 06:30:32 oslight sshd[22482]: Connection from 37.49.226.32 port 45140 on 192.168.1.251 port 22
Jun  1 06:30:32 oslight sshd[22482]: Unable to negotiate with 37.49.226.32 port 45140: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Jun  1 06:30:40 oslight sshd[22489]: Connection from 37.49.226.32 port 36036 on 192.168.1.251 port 22
Jun  1 06:30:40 oslight sshd[22489]: Unable to negotiate with 37.49.226.32 port 36036: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Jun  1 06:35:01 oslight CRON[22844]: pam_unix(cron:session): session opened for user root by (uid=0)
Jun  1 06:35:01 oslight CRON[22844]: pam_unix(cron:session): session closed for user root
Jun  1 06:39:01 oslight CRON[23213]: pam_unix(cron:session): session opened for user root by (uid=0)
Jun  1 06:39:01 oslight CRON[23213]: pam_unix(cron:session): session closed for user root
Jun  1 06:40:01 oslight CRON[23333]: pam_unix(cron:session): session opened for user freshrss by (uid=0)
Jun  1 06:40:33 oslight CRON[23333]: pam_unix(cron:session): session closed for user freshrss
Jun  1 06:42:56 oslight sshd[23607]: Connection from 178.128.113.47 port 57408 on 192.168.1.251 port 22
Jun  1 06:42:56 oslight sshd[23607]: Connection closed by 178.128.113.47 port 57408 [preauth]
Jun  1 06:42:58 oslight sshd[23610]: Connection from 106.13.228.153 port 38436 on 192.168.1.251 port 22
Jun  1 06:42:59 oslight sshd[23610]: Connection closed by 106.13.228.153 port 38436 [preauth]
Jun  1 06:45:01 oslight CRON[23766]: pam_unix(cron:session): session opened for user root by (uid=0)
Jun  1 06:45:01 oslight CRON[23765]: pam_unix(cron:session): session opened for user nextcloud by (uid=0)
Jun  1 06:45:01 oslight CRON[23766]: pam_unix(cron:session): session closed for user root
Jun  1 06:45:03 oslight CRON[23765]: pam_unix(cron:session): session closed for user nextcloud
Jun  1 06:45:33 oslight sshd[23811]: Connection from 176.37.60.16 port 50105 on 192.168.1.251 port 22
Jun  1 06:45:33 oslight sshd[23811]: Connection closed by 176.37.60.16 port 50105 [preauth]
Jun  1 06:45:55 oslight sshd[23847]: Connection from 49.232.130.25 port 52404 on 192.168.1.251 port 22
Jun  1 06:45:56 oslight sshd[23847]: Connection closed by 49.232.130.25 port 52404 [preauth]
Jun  1 06:47:09 oslight sshd[23931]: Connection from 129.204.240.42 port 39358 on 192.168.1.251 port 22
Jun  1 06:47:11 oslight sshd[23931]: Connection closed by 129.204.240.42 port 39358 [preauth]
Jun  1 06:47:29 oslight sshd[23967]: Connection from 182.151.1.126 port 37094 on 192.168.1.251 port 22
Jun  1 06:48:29 oslight sshd[23967]: Connection closed by 182.151.1.126 port 37094 [preauth]
Jun  1 06:49:09 oslight sshd[24091]: Connection from 222.95.134.120 port 44008 on 192.168.1.251 port 22
Jun  1 06:49:09 oslight sshd[24091]: Connection closed by 222.95.134.120 port 44008 [preauth]
Jun  1 06:49:19 oslight sshd[24126]: Connection from 106.12.91.36 port 44816 on 192.168.1.251 port 22
Jun  1 06:49:19 oslight sshd[24126]: Connection closed by 106.12.91.36 port 44816 [preauth]
Jun  1 06:49:31 oslight sshd[24132]: Connection from 223.171.46.146 port 63563 on 192.168.1.251 port 22
Jun  1 06:49:32 oslight sshd[24132]: Connection closed by 223.171.46.146 port 63563 [preauth]
Jun  1 06:49:57 oslight sshd[24174]: Connection from 111.229.50.131 port 38364 on 192.168.1.251 port 22
Jun  1 06:49:57 oslight sshd[24174]: Connection closed by 111.229.50.131 port 38364 [preauth]
Jun  1 06:50:01 oslight CRON[24176]: pam_unix(cron:session): session opened for user freshrss by (uid=0)
Jun  1 06:50:02 oslight CRON[24176]: pam_unix(cron:session): session closed for user freshrss
Jun  1 06:50:49 oslight sshd[24257]: Connection from 52.172.9.182 port 41636 on 192.168.1.251 port 22
Jun  1 06:50:50 oslight sshd[24257]: Connection closed by 52.172.9.182 port 41636 [preauth]
Jun  1 06:51:24 oslight sshd[24297]: Connection from 139.198.17.31 port 45782 on 192.168.1.251 port 22
Jun  1 06:51:25 oslight sshd[24297]: Connection closed by 139.198.17.31 port 45782 [preauth]
Jun  1 06:52:01 oslight CRON[24343]: pam_unix(cron:session): session opened for user root by (uid=0)
Jun  1 06:53:16 oslight sshd[24402]: error: rexec of /usr/sbin/sshd failed: No such file or directory
Jun  1 06:53:16 oslight sshd[24402]: Connection from 185.189.14.91 port 40044 on 192.168.1.251 port 22
Jun  1 06:53:16 oslight sshd[24402]: Connection closed by 185.189.14.91 port 40044 [preauth]
Jun  1 06:53:26 oslight CRON[24343]: pam_unix(cron:session): session closed for user root
Jun  1 06:54:02 oslight sshd[24417]: error: rexec of /usr/sbin/sshd failed: No such file or directory
Jun  1 06:54:02 oslight sshd[24417]: Connection from 186.147.160.189 port 53494 on 192.168.1.251 port 22
Jun  1 06:54:02 oslight sshd[24417]: Connection closed by 186.147.160.189 port 53494 [preauth]
Jun  1 06:54:24 oslight sshd[24422]: error: rexec of /usr/sbin/sshd failed: No such file or directory
Jun  1 06:54:24 oslight sshd[24422]: Connection from 139.59.59.55 port 53794 on 192.168.1.251 port 22
Jun  1 06:54:25 oslight sshd[24422]: Connection closed by 139.59.59.55 port 53794 [preauth]
Jun  1 06:55:44 oslight sshd[24433]: error: rexec of /usr/sbin/sshd failed: No such file or directory
Jun  1 06:55:44 oslight sshd[24433]: Connection from 159.65.142.103 port 37858 on 192.168.1.251 port 22
Jun  1 06:55:44 oslight sshd[24433]: Connection closed by 159.65.142.103 port 37858 [preauth]
Jun  1 06:56:16 oslight sshd[24438]: error: rexec of /usr/sbin/sshd failed: No such file or directory
Jun  1 06:56:16 oslight sshd[24438]: Connection from 104.248.121.165 port 49822 on 192.168.1.251 port 22
Jun  1 06:56:16 oslight sshd[24438]: Connection closed by 104.248.121.165 port 49822 [preauth]
Jun  1 06:56:26 oslight sshd[24441]: error: rexec of /usr/sbin/sshd failed: No such file or directory
Jun  1 06:56:26 oslight sshd[24441]: Connection from 120.236.117.205 port 55554 on 192.168.1.251 port 22
Jun  1 06:56:27 oslight sshd[24441]: Connection closed by 120.236.117.205 port 55554 [preauth]
Jun  1 06:59:14 oslight sshd[24463]: error: rexec of /usr/sbin/sshd failed: No such file or directory
Jun  1 06:59:14 oslight sshd[24463]: Connection from 125.65.86.164 port 45950 on 192.168.1.251 port 22
Jun  1 06:59:15 oslight sshd[24463]: Connection closed by 125.65.86.164 port 45950 [preauth]
Jun  1 07:00:01 oslight CRON[24468]: PAM _pam_init_handlers: no default config /etc/pam.d/other
Jun  1 07:00:01 oslight CRON[24468]: PAM error reading PAM configuration file
Jun  1 07:00:01 oslight CRON[24468]: PAM pam_start: failed to initialize handlers
Jun  1 07:00:01 oslight CRON[24469]: PAM _pam_init_handlers: no default config /etc/pam.d/other
Jun  1 07:00:01 oslight CRON[24469]: PAM error reading PAM configuration file
Jun  1 07:00:01 oslight CRON[24469]: PAM pam_start: failed to initialize handlers
Jun  1 07:02:38 oslight sshd[24487]: error: rexec of /usr/sbin/sshd failed: No such file or directory
Jun  1 07:02:38 oslight sshd[24487]: Connection from 209.141.40.12 port 43378 on 192.168.1.251 port 22
Jun  1 07:02:39 oslight sshd[24487]: Did not receive identification string from 209.141.40.12 port 43378
Jun  1 07:04:06 oslight sshd[24495]: error: rexec of /usr/sbin/sshd failed: No such file or directory
Jun  1 07:04:06 oslight sshd[24495]: Connection from 106.124.140.36 port 39108 on 192.168.1.251 port 22
Jun  1 07:04:07 oslight sshd[24495]: Connection closed by 106.124.140.36 port 39108 [preauth]
Jun  1 07:04:51 oslight sshd[24500]: error: rexec of /usr/sbin/sshd failed: No such file or directory
Jun  1 07:04:51 oslight sshd[24500]: Connection from 106.13.230.250 port 50778 on 192.168.1.251 port 22
Jun  1 07:04:52 oslight sshd[24500]: Connection closed by 106.13.230.250 port 50778 [preauth]
Jun  1 07:06:07 oslight sshd[24511]: error: rexec of /usr/sbin/sshd failed: No such file or directory
Jun  1 07:06:07 oslight sshd[24511]: Connection from 159.65.140.38 port 53458 on 192.168.1.251 port 22
Jun  1 07:06:07 oslight sshd[24511]: Connection closed by 159.65.140.38 port 53458 [preauth]
Jun  1 07:10:01 oslight CRON[24539]: PAM _pam_init_handlers: no default config /etc/pam.d/other
Jun  1 07:10:01 oslight CRON[24539]: PAM error reading PAM configuration file
Jun  1 07:10:01 oslight CRON[24539]: PAM pam_start: failed to initialize handlers
Jun  1 07:10:04 oslight sshd[24541]: error: rexec of /usr/sbin/sshd failed: No such file or directory
Jun  1 07:10:04 oslight sshd[24541]: Connection from 85.209.0.101 port 57320 on 192.168.1.251 port 22
Jun  1 07:10:05 oslight sshd[24542]: error: rexec of /usr/sbin/sshd failed: No such file or directory
Jun  1 07:10:05 oslight sshd[24542]: Connection from 85.209.0.101 port 8944 on 192.168.1.251 port 22
Jun  1 07:10:05 oslight sshd[24542]: Did not receive identification string from 85.209.0.101 port 8944
Jun  1 07:10:05 oslight sshd[24543]: error: rexec of /usr/sbin/sshd failed: No such file or directory
Jun  1 07:10:05 oslight sshd[24543]: Connection from 85.209.0.101 port 57304 on 192.168.1.251 port 22
Jun  1 07:10:09 oslight sshd[24543]: Invalid user root from 85.209.0.101 port 57304
Jun  1 07:10:09 oslight sshd[24543]: input_userauth_request: invalid user root [preauth]
Jun  1 07:10:09 oslight sshd[24543]: PAM _pam_init_handlers: no default config /etc/pam.d/other
Jun  1 07:10:09 oslight sshd[24543]: PAM error reading PAM configuration file
Jun  1 07:10:09 oslight sshd[24543]: PAM pam_start: failed to initialize handlers
Jun  1 07:10:09 oslight sshd[24543]: PAM pam_end: NULL pam handle passed
Jun  1 07:10:09 oslight sshd[24543]: fatal: PAM: initialisation failed
Jun  1 07:10:09 oslight sshd[24541]: Invalid user root from 85.209.0.101 port 57320
Jun  1 07:10:09 oslight sshd[24541]: input_userauth_request: invalid user root [preauth]
Jun  1 07:10:09 oslight sshd[24541]: PAM _pam_init_handlers: no default config /etc/pam.d/other
Jun  1 07:10:09 oslight sshd[24541]: PAM error reading PAM configuration file
Jun  1 07:10:09 oslight sshd[24541]: PAM pam_start: failed to initialize handlers
Jun  1 07:10:09 oslight sshd[24541]: PAM pam_end: NULL pam handle passed
Jun  1 07:10:09 oslight sshd[24541]: fatal: PAM: initialisation failed
Jun  1 07:15:01 oslight CRON[24593]: PAM _pam_init_handlers: no default config /etc/pam.d/other
Jun  1 07:15:01 oslight CRON[24593]: PAM error reading PAM configuration file
Jun  1 07:15:01 oslight CRON[24593]: PAM pam_start: failed to initialize handlers
Jun  1 07:16:46 oslight sshd[24605]: error: rexec of /usr/sbin/sshd failed: No such file or directory
Jun  1 07:16:46 oslight sshd[24605]: Connection from 106.13.118.102 port 47618 on 192.168.1.251 port 22
Jun  1 07:16:47 oslight sshd[24605]: Connection closed by 106.13.118.102 port 47618 [preauth]
Jun  1 07:18:45 oslight sshd[24625]: error: rexec of /usr/sbin/sshd failed: No such file or directory
Jun  1 07:18:45 oslight sshd[24625]: Connection from 111.93.235.74 port 48217 on 192.168.1.251 port 22
Jun  1 07:18:45 oslight sshd[24625]: Connection closed by 111.93.235.74 port 48217 [preauth]
Jun  1 07:20:01 oslight CRON[24633]: PAM _pam_init_handlers: no default config /etc/pam.d/other
Jun  1 07:20:01 oslight CRON[24633]: PAM error reading PAM configuration file
Jun  1 07:20:01 oslight CRON[24633]: PAM pam_start: failed to initialize handlers
Jun  1 07:23:05 oslight sshd[24652]: error: rexec of /usr/sbin/sshd failed: No such file or directory
Jun  1 07:23:05 oslight sshd[24652]: Connection from 85.235.34.62 port 44796 on 192.168.1.251 port 22
Jun  1 07:23:05 oslight sshd[24652]: Connection closed by 85.235.34.62 port 44796 [preauth]
Jun  1 07:28:29 oslight sshd[24691]: error: rexec of /usr/sbin/sshd failed: No such file or directory
Jun  1 07:28:29 oslight sshd[24691]: Connection from 170.83.76.187 port 51528 on 192.168.1.251 port 22
Jun  1 07:28:30 oslight sshd[24691]: Connection closed by 170.83.76.187 port 51528 [preauth]
Jun  1 07:30:01 oslight CRON[24701]: PAM _pam_init_handlers: no default config /etc/pam.d/other
Jun  1 07:30:01 oslight CRON[24702]: PAM _pam_init_handlers: no default config /etc/pam.d/other
Jun  1 07:30:01 oslight CRON[24702]: PAM error reading PAM configuration file

je ne suis pas sur de bien interpreter : des ip asiatiques ont reussi a se connecter ?

Je pense que je vais devoir refaire une installation propre et y mettre mes derniers backups non ?

Aleks · June 3, 2020, 5:40pm

Du coup je semble déduire que tu avais fait un symlink de /home/yunohost.backup vers /media/Data/AppData/Serveurs/yunohost_backups … est-ce que tu préciser si le symlink tu l’as fais sur

/home/yunohost.backup

ou bien

/home/yunohost.backup/archives

Oni-Shadow · June 3, 2020, 5:42pm

j’avais defini ce dossier comme repertoire par defaut pour les sauvegardes YNH

@ljf c’ etait ma premiere hypothese etant donne que le SSD est soude a la carte , j’avais cherche des softs pour faire cela mais je ne suis pas sur du nom de celui que j’ ai utilise, dans le doute je vais refaire un test !

(ps : desole, je suis sur le MBA qui me servait de serveur, qui est en qwerty --> pas d’accents !)

Oni-Shadow · June 3, 2020, 5:45pm

@Aleks
je l’ ai fait sur /home/yunohost.backup/archives cf :

ls /mnt/home/yunohost.backup/ -l
total 12
lrwxrwxrwx 1 root root   58 mai    4 16:42 archives -> /media/Data/AppData/Serveurs/yunohost_backups
drwxr-x--- 2 1007 root 4096 mai    3 20:33 archives.old
drwxr-x--- 2 root root 4096 mars  27 16:42 premigration
drwxr-x--- 2 1007 root 4096 mai   25 15:14 tmp

Aleks · June 3, 2020, 5:50pm

Et tu n’aurais pas une idée d’un truc qui aurait ajouté un lien symbolique ou dur dans le dossier archives d’une façon ou d’une autre ?

En tout cas étant donné que le problème a commencé à survenir 5 secondes après l’execution du cron job monthly, et que le cron job contient un truc de suppression récursive, ça ressemble furieusement à l’explication … Si tu veux t’en assurer tu peux regarder la date des fichiers encore sur le disque pour voir si “par hasard” ce ne serait pas des fichiers plus récent que 40 jours

ljf · June 3, 2020, 5:52pm

Que donne ls -la /home/yunohost.backup/archives ?

Oni-Shadow · June 3, 2020, 5:57pm

@Aleks Malheuresement non … Je pense que tu as raison mais j’ ai ajoute ce cron en debut de mois, apres avoir lancer une execution du script a la main pour verifier que tout marchait bien, ca s’etait bien passe
je ne vois pas pourquoi il y aurait un lien depuis mais why not

en tout cas merci pour le temps passe a regarde tout ca, je vais laisser un petit don dans une de vos cagnotes

je vais continuer a checker le SSH mais ca commence bien si ca se confirme, j’essaiyerais de restorer

sudo smartctl -H -i /dev/sda
smartctl 7.1 2019-12-30 r5022 [x86_64-linux-5.4.0-26-generic] (local build)
Copyright (C) 2002-19, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF INFORMATION SECTION ===
Model Family:     Apple SD/SM/TS...E/F/G SSDs
Device Model:     APPLE SSD SD0128F
Serial Number:    142620412183
LU WWN Device Id: 5 001b44 c406bc517
Firmware Version: A222821
User Capacity:    121 332 826 112 bytes [121 GB]
Sector Sizes:     512 bytes logical, 4096 bytes physical
Rotation Rate:    Solid State Device
Form Factor:      3.5 inches
Device is:        In smartctl database [for details use: -P show]
ATA Version is:   ATA8-ACS T13/1699-D revision 6
SATA Version is:  SATA 3.0, 6.0 Gb/s (current: 6.0 Gb/s)
Local Time is:    Wed Jun  3 19:50:03 2020 CEST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED

Oni-Shadow · June 3, 2020, 5:59pm

@ljf je l’ avais mis plus haut mais voila

ls -la /mnt/home/yunohost.backup/archives
lrwxrwxrwx 1 root root 58 mai    4 16:42 /mnt/home/yunohost.backup/archives -> /media/Data/AppData/Serveurs/yunohost_backups

ljf · June 3, 2020, 6:00pm

Et

ls -la /media/Data/AppData/Serveurs/yunohost_backups

Oni-Shadow · June 3, 2020, 6:15pm

c’est sur un HDD qui est monte sur /media/Data normalement, la je l’ ai monte sur SyncData

$ sudo ls -la /media/cedc/syncData/AppData/Serveurs/yunohost_backups/
total 24786192
drwxr-x--- 2             1007 root                    4096 mai   25 15:14 .
drwxrwxrwx 6 systemd-coredump systemd-coredump        4096 juin   1 06:52 ..
-rw-r--r-- 1 root             root                    2487 mai    3 20:33 20200503-161741.info.json
-rw-r--r-- 1 root             root             24947617343 mai    3 20:33 20200503-161741.tar.gz
-rw-r--r-- 1 root             root                     335 mai   25 15:12 freshrss-pre-upgrade1.info.json
-rw-r--r-- 1 root             root                14840405 mai   25 15:12 freshrss-pre-upgrade1.tar.gz
-rw-r--r-- 1 root             root                     412 mai   25 15:08 nextcloud-pre-upgrade1.info.json
-rw-r--r-- 1 root             root               266384919 mai   25 15:08 nextcloud-pre-upgrade1.tar.gz
-rw-r--r-- 1 root             root                     333 mai   25 15:14 pixelfed-pre-upgrade2.info.json
-rw-r--r-- 1 root             root               141292443 mai   25 15:14 pixelfed-pre-upgrade2.tar.gz
-rw-r--r-- 1 root             root                     251 avril 25 16:07 qr-pre-upgrade1.info.json
-rw-r--r-- 1 root             root                10881000 avril 25 16:07 qr-pre-upgrade1.tar.gz