Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: SLES 11.2 slow SSH password prompt
Operating Systems Linux SuSE SLES 11.2 slow SSH password prompt Post 302728717 by j_aix on Thursday 8th of November 2012 09:42:52 AM
Old 11-08-2012
SLES 11.2 slow SSH password prompt
We are having an issue with slow password prompts via SSH login on all of our SLES 11.2 boxes. The output from a ssh -v login attempt shows a delay here:
Code:
debug1: SSH2_MSG_SERVICE_ACCEPT received

This issue only happens on the first logon of the day; subsequent logons are normal. Adding the client's workstation hostname/IP to /etc/hosts, and setting "UseDNS no" in /etc/ssh/sshd_config has no effect. Both the client and server can resolve respective hostnames and IP's via nslookup and dig as well.

The peculiar side is that we also have a few SLES 10.4 boxes without this issue. Between these two versions, all of the applicable config files are identical. The only server-side difference we can see thus far is the version of OpenSSH, which is minor:

SLES 11.2 = OpenSSH_5.1p1, OpenSSL 0.9.8j-fips 07 Jan 2009
SLES 10.4 = OpenSSH_5.1p1, OpenSSL 0.9.8a 11 Oct 2005

Update 11/29/12: We performed a trace during the delay and our network team found something interesting. During the first logon of the day, there is a massive ldap query performed against the AD forest, as if a cache has expired and needs refreshed. This could explain why the delay only happens once a day. We are looking into the samba/winbind configs to see if there is a setting that controls when the cache expires. Perhaps the "winbind cache time" parm could be of value to us since these servers don't have routine ldap activity.

Suggestions?
Last edited by j_aix; 11-29-2012 at 11:35 AM..
 

10 More Discussions You Might Find Interesting

1. UNIX and Linux Applications

SSH: Avoiding password prompt with rsa key generation

Hi, I am using a remote storage service for backing up our data - we want to have a script run as part of a cron job which would do the backups from our local Linux machine to the service's Linux machine. I want to use tar and ssh to do this (rather than mounting the disk and using cp) .... (5 Replies)
Discussion started by: same1290
5 Replies

2. Linux

SSH user equivalency still prompt for password

Hi All, I've followed the exact same steps of how to setup and enable SSH user equivalent including the right permission, but when I "ssh" it still prompts for password. Could you help to see what I did wrong? I appreciate any helps. :confused: server1.com:/u01/oracle RAC1 > mkdir... (2 Replies)
Discussion started by: Beginer0705
2 Replies

3. UNIX for Dummies Questions & Answers

SSH version of rlogin (ie without password prompt)

I have 3 Solaris 10 UNIX servers, the shadow and passwd file are all identical and are automatically sync every 5 minutes. A majority of the users do not have CLI access but rather use a menu. I currently have menu options that allows them to rlogin to another server and I need to have the... (1 Reply)
Discussion started by: creedonjm
1 Replies

4. Solaris

expired password prompt at ssh login

Hi, I am using DSEE 6.3 to authenticate and authorize my Solaris 9 and 10 users. Everything works fine except password expiration. I use built-in global password policy for all users. The policy works well. However I could not find the right pam configuration in order to prompt users at ssh... (2 Replies)
Discussion started by: niyazi
2 Replies

5. SuSE

user simple password SLES

Hello, I would like to change a password of a user to a simple one but when i try to add an only lowercase pass i get the error: Weak password: too short. Try again. You can now choose the new password. A valid password should be a mix of upper and lower case letters, digits, and... (2 Replies)
Discussion started by: @dagio
2 Replies

6. SuSE

SLES 9 vs SLES 11 hard drive cache read timings are diffrent

Can anyone give me a little clue on why the hard drive cache read timings on sles 9 is better then sles 11? The same hardware was used in both test. I even deleted the ata_generic module from initrd. The speed difference is 10MB vs 5 MB Thanks (1 Reply)
Discussion started by: 3junior
1 Replies

7. AIX

ssh keys - no password prompt from AIX to RPA

hello, i am running an AIX 5.3 machine and i want to connect via ssh to the RPA Management site without prompting for password. i already had a public key of this server as i use the same thing for ssh connection with other AIX machines. i connected to the RPA Management Site and i run the... (9 Replies)
Discussion started by: omonoiatis9
9 Replies

8. Programming

Test SSH but do not return password prompt

Hello forum, I want to have a function to test for passwordless SSH setup. Pretty simple. However, what I'm finding difficult is to NOT return a password prompt to screen IF it's not in place. Here's the function: check_passwordless_ssh_working() #check passed parameter, assuming it is... (4 Replies)
Discussion started by: doonan_79
4 Replies

9. Red Hat

Sudo Password Prompt over SSH

I am not sure what I am missing here. I have the following identical entry in /etc/sudoers on multiple Red Hat 6.4 servers. icinga ALL=NOPASSWD:/usr/bin/yum --security --exclude\="kernel*" check-update On one server when I enter the command over SSH as follows it works fine. ssh -t -q... (1 Reply)
Discussion started by: scotbuff
1 Replies

10. Shell Programming and Scripting

How to pass password and prompt user for IP address while doing ssh and scp?

Hi All, I want to copy /.ssh/OM.pub file from source to destination. Here source IP address, username and password is always fixed. Whereas destination server IP address, password always gets changed. From destination server :- I am trying to write a script in which it should log in to... (3 Replies)
Discussion started by: madhur.baharani
3 Replies

LEARN ABOUT DEBIAN

fence_rsa

FENCE_AGENT(8)						      System Manager's Manual						    FENCE_AGENT(8)

NAME

       fence_rsa - Fence agent for IBM RSA

DESCRIPTION

       fence_rsa  is an I/O Fencing agent which can be used with the IBM RSA II management interface. It logs into an RSA II device via telnet and
       reboots the associated machine. Lengthy telnet connections to the RSA II device should be avoided while a GFS cluster  is  running  because
       the connection will block any necessary fencing actions.

       fence_rsa  accepts  options  on	the  command  line  as	well as from stdin. Fenced sends parameters through stdin when it execs the agent.
       fence_rsa can be run by itself with command line options.  This is useful for testing and for turning outlets on or off from scripts.

       Vendor URL: http://www.ibm.com

PARAMETERS


       -o, --action=<action>
	      Fencing Action (Default Value: reboot)

       -a, --ip=<ip>
	      IP Address or Hostname This parameter is always required.

       -l, --username=<name>
	      Login Name This parameter is always required.

       -p, --password=<password>
	      Login password or passphrase

       -S, --password-script=<script>
	      Script to retrieve password

       -c, --command-prompt=<prompt>
	      Force command prompt (Default Value: >)

       -x, --ssh
	      SSH connection

       -k, --identity-file=<filename>
	      Identity file for ssh

       -u, --ipport=<port>
	      TCP port to use for connection with device

       -v, --verbose
	      Verbose mode

       -D, --debug-file=<debugfile>
	      Write debug information to given file

       -V, --version
	      Display version information and exit

       -h, --help
	      Display help and exit

       --power-timeout
	      Test X seconds for status change after ON/OFF (Default Value: 20)

       --shell-timeout
	      Wait X seconds for cmd prompt after issuing command (Default Value: 3)

       --login-timeout
	      Wait X seconds for cmd prompt after login (Default Value: 10)

       --power-wait
	      Wait X seconds after issuing ON/OFF (Default Value: 0)

       --delay
	      Wait X seconds before fencing is started (Default Value: 0)

       --retry-on
	      Count of attempts to retry power on (Default Value: 1)

ACTIONS


       on     Power on machine.

       off    Power off machine.

       reboot Reboot machine.

       status This returns the status of the plug/virtual machine.

       list   List available plugs with aliases/virtual machines if there is support for more then one device. Returns N/A otherwise.

       monitor
	      Check if fencing device is running. List available plugs/virtual machines or get status of machine (if it does  not  support  more).

       metadata
	       The operational behavior of this is not known.

STDIN PARAMETERS


       action Fencing Action (Default Value: reboot)

       ipaddr IP Address or Hostname This parameter is always required.

       login  Login Name This parameter is always required.

       passwd Login password or passphrase

       passwd_script
	      Script to retrieve password

       cmd_prompt
	      Force command prompt (Default Value: >)

       secure SSH connection

       identity_file
	      Identity file for ssh

       ipport TCP port to use for connection with device

       verbose
	      Verbose mode

       debug  Write debug information to given file

       version
	      Display version information and exit

       help   Display help and exit

       power_timeout
	      Test X seconds for status change after ON/OFF (Default Value: 20)

       shell_timeout
	      Wait X seconds for cmd prompt after issuing command (Default Value: 3)

       login_timeout
	      Wait X seconds for cmd prompt after login (Default Value: 10)

       power_wait
	      Wait X seconds after issuing ON/OFF (Default Value: 0)

       delay  Wait X seconds before fencing is started (Default Value: 0)

       retry_on
	      Count of attempts to retry power on (Default Value: 1)

fence_rsa (Fence Agent) 					    2009-10-20							    FENCE_AGENT(8)
All times are GMT -4. The time now is 10:02 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy