topic Re: SSHD logging question in Operating System - HP-UX

SSHD logging question

Chrisl_2 — Tue, 04 Apr 2006 10:32:24 GMT

HPUX 11.00 PARISC

Hi all,

sshd logging to syslog seems to have the time set to EDT. Unfortunately we are in PDT. The host time and the client systems all have the time set correctly. Anyone know where to look for this?

TIA Chris

Re: SSHD logging question

Alzhy — Tue, 04 Apr 2006 12:28:58 GMT

Have you checked IF your server is actually on PDT Timezone?

# echo $TZ
PST8PDT

Re: SSHD logging question

Mel Burslan — Tue, 04 Apr 2006 12:29:06 GMT

I don't think sshd has a separate timezone setting but it uses the system time when it logs. What is your /etc/TIMEZONE file contents say about your timezone as the most trivial point of starting the troubleshooting ?

If it is set correctly, could you please paste a snippet of your syslog to see how the log time jumps back and forth between few entries ?

Re: SSHD logging question

Chrisl_2 — Tue, 04 Apr 2006 12:48:20 GMT

Here's a bit of syslog.log

Apr 4 14:43:48 dining sshd[10645]: Accepted publickey for bak from 132.239.29.96 port 41568 ssh2
Apr 4 14:43:49 dining sshd[10652]: Accepted publickey for bak from 132.239.29.96 port 41569 ssh2
dining:/var/adm/syslog>tail -100 syslog.log |more
Apr 4 10:14:03 dining ftpd[9946]: FTP session closed

here's the TZ

dining:/var/adm/syslog>echo $TZ
PST8

here's /etc/timezone

dining:/var/adm/syslog>cat /etc/TIMEZONE
TZ=PST8
export TZ

Re: SSHD logging question

Mel Burslan — Tue, 04 Apr 2006 12:55:49 GMT

my /etc/TIMEZONE says:

# cat TIMEZONE
TZ=PST8PDT
export TZ

I am not sure if it is related to your problem (the lack of PDT in the TZ definition), but you sure can try and it won't hurt anything.

also which version of of sshd are you running ?

just telnet to the port 22 (or other if you are running it on an unusual setup) of your host and see what it says. I am not sure what else to suggest or ask.

Re: SSHD logging question

A. Clay Stephenson — Tue, 04 Apr 2006 12:58:37 GMT

Note than sshd is started by rc. Rc normally sources /etc/TIMEZONE but if that file was not found then TZ is hardset to EST5EDT and exported to any child processes including sshd. At this point all we can know is the contents of /etc/TIMEZONE as it is now; that does not mean that we know the contents when sshd was actually started.

I would (from the console) issue an /sbin/init.d/secsh stop and /sbin/init.d/secsh start.

Re: SSHD logging question

Steven E. Protter — Tue, 04 Apr 2006 12:59:54 GMT

Shalom Chris!

There have been some problems with connection logging in recent secure shell openssh versions.

The latest version 4.2.004 corrects some of these.

Perhaps check version.

swlist -l product | grep -i secure

SEP

Re: SSHD logging question

Chrisl_2 — Tue, 04 Apr 2006 13:01:43 GMT

This issue has been around longer than the time change this past Saturday, so I don't think that it is a daylight savings time issue. I think somewhere, ssh thinks that the system is in EST, I'm just not sure where it gets this info.

the version of ssh is

dining:/var/adm/syslog>ssh -v
OpenSSH_3.8p1, SSH protocols 1.5/2.0, OpenSSL 0.9.6b 9 Jul 2001

thanks

Re: SSHD logging question

Chrisl_2 — Tue, 04 Apr 2006 13:22:00 GMT

BTW, I have 2 other systems running SSH. They do have PST8PDT in /etc/TIMEZONE. They are logging time correctly. Maybe that is it. If I kill HUP the sshd process, will users that have current ssh connections get interrupted?

TIA

Re: SSHD logging question

Mel Burslan — Tue, 04 Apr 2006 13:34:37 GMT

as Clay indicated, /sbin/init.d/secsh stop and then start should not affect the users already logged in. For a brief time between the issuance of stop and start commands, 5-10 seconds may be, people who want to start a new ssh session may get connection refused message.

Also, check your ssh version and upgrade to something recent if at all possible. As Stephen indicated, older versions had some logging and authentication problems.