Dropbear error for 1 second twice a day causing outage - please help me

Installing and Using OpenWrt
1

For about a month now, I have a 1 second internet blip at exactly noon and midnight. I finally found the system log, where there are the same 4 lines listed every time:

"authpriv.info dropbear[a number]: Early exit: Terminated by signal
authpriv.info dropbear[^number +1]: Early exit: Terminated by signal
authpriv.info dropbear[a number]: Not backgrounding
authpriv.info dropbear[^number +1]: Not backgrounding"

I cannot figure this out for the life of me. I'm semi-literate at best with OpenWrt and have been Googling my butt off with no luck. OpenWrt was initially set up for me by a family member a couple of years ago, and was basically untouched since then. Since I noticed the blips starting, I've done a firmware update to 19.07.6 but that didn't change my situation.

I'll provide more information if it helps; I'm just going a little nuts with this. Thanks in advance for any help or tips.

2

Dropbear is the SSH Server, this should not be related to your Internet connection. If it is everyday at the same time I would expect it is either a cronjob running or it is actually your internet provider. How is your internet connection? Is it Ethernet/Fiber or is it DSL with PPPOE?

1 Like
3

Thank you for the response. I'm connected through Ethernet.

You are correct. There is another line I missed in the system log that's appeared in them as well:

cron.info crond[a number]: USER support pid 12454 cmd /etc/config/initd

4

Then check for any cronjob configured

2 Likes
5

Thanks for the continued replies, and apologies if I'm missing something obvious; like I said, I have very little experience/knowledge of OpenWrt.

Now that you mentioned cronjobs, I looked again at the system log and discovered that this is apparently happening every 6 hours. I only noticed it at noon and midnight due to being home on lunch breaks or working late often.

This is what's in the log every time (the numbers in brackets vary):

Fri Jan 29 06:00:00 2021 cron.info crond[32157]: USER support pid 22566 cmd /etc/config/initd
Fri Jan 29 06:00:00 2021 authpriv.info dropbear[32069]: Early exit: Terminated by signal
Fri Jan 29 06:00:00 2021 authpriv.info dropbear[32070]: Early exit: Terminated by signal
Fri Jan 29 06:00:01 2021 authpriv.info dropbear[22614]: Not backgrounding
Fri Jan 29 06:00:01 2021 authpriv.info dropbear[22613]: Not backgrounding
Fri Jan 29 06:00:02 2021 cron.info crond[22701]: crond (busybox 1.30.1) started, log level 8

I've checked the Scheduled Tasks menu multiple times in the past month and again a minute ago and it is completely empty. I'm not sure where this is coming from. Thanks again for your patience. I'm trying :slight_smile:

6

So this basically means that a user support is executing a command at that time. So means whoever has setup the device for you did quite some special job. Easiest would be to ask them.
Otherwise login via SSH to the router and run crontab -l -u support

3 Likes
7

image

Success!... I think lol. So did that permanently kill/cancel whatever cronjob was setup for every 6 hours? Thanks again

8

So did you deleted both jobs? If I were you I would have checked what is written in /etc/config/initd and /etc/killreboot.sh.
Furthermore you may want to reconsider a full reinstall unless you are clear that all this was configured for a purpose.

9

Well, I guess this is where I prove my lack of knowledge. All I did was enter "crontab -l -u support"

I am now realizing it looks like all I did was list out the cron jobs? So I believe they're still there. I'd love to know what is written in them. I'm just not sure how

10

cat /etc/config/initd
cat /etc/killreboot.sh

To delete the jobs crontab -r -u support
But as written unless you know what the person had in mind when doing this I would suggest a full reinstall.

3 Likes
11

This topic was automatically closed 0 minutes after the last reply. New replies are no longer allowed.