relatioship between, ssh,pam.conf, password length and delay in getting password prompt

[Rajanish C]

Hi,
i am having 2 rp series machines running hp ux 11.11 in trusted mode. After a reboot one of the machine is having problem with ssh login using putty. if i enable "use pam=yes" then it take about 2 minute to get the password prompt after i type in the user name. if i un set the "use pams=yes" option then it is giving access denied to any user having a password of more than 8 charecter length. on the other machine it is "use pams=yes" enabled and it takes paswords which are longer than 8 charecters and dont have any issue in getting the prompt too. both are running latest QPK and ssh version is 4.something.(i forgot to not this excatly)
Regards
Rajanish C

[RAC_1]

Did you check nslookup on the server where you have problem? Can you do telnet and check. This will confirm if delay is associated with ssh or not. From client nslookup on slow server-on ip address and on hostname.

[Steven E. Protter]

Shalom

Non-trusted hp-ux systems ignore passwords greater than 8 characters.

The delay you experience is probably a network delay, you should check /etc/resolv.conf name resolution for delays.

SEP

[Steven E. Protter]

Shalom

Non-trusted hp-ux systems ignore passwords greater than 8 characters.

The delay you experience is probably a network delay, you should check /etc/resolv.conf name resolution for delays.

swlist -l product | grep -i secure

Anything but the lastest Secure Shell is known to have problems. 4.2.004 is what you need.


SEP

[Rajanish C]

Hi,
I have mentioned it already that the system is running in trusted mode and i am not having any issue with telnet/ftp
Regards
Rajanish C

[RAC_1]

What if you set PAM=yes and enter just first 8 chars of password?

[Haralambos]

see also the following thread:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1018433

[Rajanish C]

Hi,
If i set "usePAM=yes" it solves the problem with password length but it takes a long time (around 2 minutes) for the password prompt to appear.
Regards
Rajanish C

[Bill Hassell]

You may want to get a trace of the sshd login to see which step is having a problem. You may find that the call to generate a random number is the culprit. Without the new random number generator (KRNG), a number of system queries are done to obtain a certain amount of entropy (randomness), some of which require a long time to run on certain configurations. See patch PHKL_27750.