> > The permissions of /dev/null change directly after (or maybe even
quoted text
> > while) using SFTP, and not always.
>
> It's not just permissions, it's no longer a character special (device)
> file, it's a regular file.  This usually happens when /dev/null is
> deleted, and sooner or later something with root perms will write to it,
> at which point it gets recreated as a regular file.

Yes, that might be it.

quoted text
> > Sometimes I can log in several
> > times over a few hours without fixing /dev/null, and then again only
> > one single time. E.g. right now I can't reproduce the error. And if I
> > don't use SCP/SFTP at all, everything works fine, for weeks, so it
> > seems to be related to SCP/SFTP.
>
> During that time, is /dev/null still a character special, or has it
> turned into a regular file?

I'm quite sure it's still a character special during that time (or at
least most of that time). Every time I checked it was one, though I
never checked directly before using SCP or SFTP, especially not after
I was hoping that last snapshot installation had fixed it.

quoted text
> I suspect that something else (maybe a cron job?) is removing /dev/null
> and the scp/sftp error is just a symptom.

Yes, that's possible, though on that server are only the original
cronjobs which came with the default install. I didn't add any
additional cronjob.

quoted text
> You could try something like this running from cron regularly:
>
> test -c /dev/null || echo /dev/null vanished or not character special
>
> and see if/when it starts mailing you.

Good idea, I'll try that, but maybe it's even not necessary? I have
the timestamp on the regular file which was created somehow (from my
first post):

quoted text
> /dev root# ls -l null
> -rw-------  1 root  wheel  56 Mar 27 18:13 null

So I checked /var/log for this timestamp (I hope I catched all entries
this way, I'm not an professional like many of you are, though I learn
more and more about OpenBSD and it's a lot of fun for me :-) ):

# zgrep 'Mar 27 18:1' /var/log/*
/var/log/daemon:Mar 27 18:13:12 tas identd[20077]: Connection from localhost
/var/log/daemon:Mar 27 18:13:12 tas identd[13260]: Connection from localhost
/var/log/daemon:Mar 27 18:13:12 tas identd[24972]: Connection from localhost
/var/log/daemon:Mar 27 18:13:17 tas identd[20077]: scanf:
invalid-port(s): 0 , 0 from localhost
/var/log/maillog.0.gz:Mar 27 18:13:12 tas sm-mta[22178]:
l2RGDCfv022178: root@localhost [127.0.0.1] did not issue
MAIL/EXPN/VRFY/ETRN during connection to MTA
/var/log/maillog.0.gz:Mar 27 18:13:12 tas sm-mta[1887]:
l2RGDCxT001887: root@localhost [127.0.0.1] did not issue
MAIL/EXPN/VRFY/ETRN during connection to MSA
/var/log/messages.0.gz:Mar 27 18:13:17 tas identd[20077]: scanf:
invalid-port(s): 0 , 0 from localhost

Does that help somehow?

Tas.