ssh takes a long to login (ssh_prng_cmds)

[Unix Administrator_5]

I have hp's version of ssh running on HPUX 11.0

When I try ot ssh to another system -- it takes a long time to connect. By commenting out several of the cmds in ssh_prng_cmds i have reduced this time considerably.

However, it still takes 5 - 10 seconds, and I am thinging that much of this comes from the cmds. Is there a safe workaround to this? any way of generating enough output to generate an adequate psuedo random number in less time?

[Steven E. Protter]

The newer version of Secure Shell 3.5 and up deal with this issue substantially.

http://software.hp.com

Search for Secure Shell(SEP is lazy today)

Its not a complete fix for 11.00 because there is no strong random number generator add in for 11.00.

SEP

[RAC_1]

This is beacuse of random number generation.
HP has free random number generator product.

You need to configure ssh to use that.

There is very good article by Chris Wong on this.

Search the forum.

[Jeff Schussele]

Hi,

HP has a rather new product - KRNG11I I believe is the name - which will alleviate the need to generatet pseudo random numbers via the commands.
But this is for 11iv1 or higher only.
Can be had here:

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=KRNG11I

And it's included with SSH ver A.03.61.001 - here

http://www.software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=T1471AA

HTH,
Jeff

[Unix Administrator_5]

It is my understanding that the free product is for 11i not 11.0

Is there anyway to reduct the amount of time that it takes to product this random number.

[Jeff Schussele · Accepted solution]

Hi,

Yes, look over the commands in the ssh_prng_cmds file & determine just *which* commands are the time hogs & replace them with faster running commands.

BTW - 11.0 will be discontinued at the end of FEB coming up, so now is the time to start planning your 11i upgrade & you now have a good reason to do so.

HTH,
Jeff

[Unix Administrator_5]

Does it matter what commands I use?
And what should the entropy be for the commands?

[Jeff Schussele]

Hi,

1) Not really (As you'll see)

2) Entropy should be based on the inherent randomness of the command's output. For EX an ioscan -fn or netstat -in command output will rarely change. But ps, vmstat & tails of log files will change frequently. BUT you have to balance using TOO many bits of the VERY random commands or the calculations will take much longer.

Which brings us to the another point - that it's possible to speed up your SSH calculations by not only changing commands, but by varying the entropy or bits per byte collected from the prng commands.
Experiment a little. Look over the file & if you have large (0.05, 0.06, 0.07, etc) values for a LOT of the real random commands, you might try lowering some of those values and increasing them on the commands that aren't so random & mitigate the problem w/o having to change commands at all.

Rgds,
Jeff

[Pratyush Paul_1]

Hi -

You need to use prngd in order to make ssh work efficently. I would suggest that you down load the latest openssh and compile it on your system, this is what you use to compile and build openssh 3.7.p1

#./configure --prefix=/opt/openssh --sysconfdir=/etc/ssh --with-prngd
#make
#make test
#make install.

Please note you have to use openssl 0.9.7c and zlib 1.1.4

Let me know if you need any additional support.

thanks

Pratyush