Strange SSH Problem

[Mark Hopkins_6]

Hello,

I recently built an 11.0 32-bit OS, then installed pathces and then installed HP Secure Shell (T1471AA_A.04.00.000_HP-UX_B11.00_32+64.depot). After rebooting to check the auto-start, things seemed fine. However I noticed two things:

(1) The daemon takes much longer to respond to a login request than I expect, even after disabling DNS checks.

(2) More importantly, I can only ssh to this server one time with any account. After that I receive an authentication error. If I restart the daemon, I get one more. If I change to Protocol 1 it work fine, however I want to use Protocol 2 for security reasons. If I ssh from the server to itself, everything works fine.

I am using as a client SSH Tectia V4.3.3 (Build 33).

Any help is certainly appreciated.

-Mark

[Mark Hopkins_6]

By the way, this ssh client currently works flawlessly with every Solaris server in my shop.

[Steven E. Protter]

I think there is a newer version of Secure Shell available.

That might be a good place to start.

I doubt its your client, but why not try another free one out just for grins.

http://www.google.co.il/url?sa=t&ct=res&cd=1&url=http%3A//www.chiark.greenend.org.uk/%7Esgtatham/putty/&ei=l-YdQ-SzEqiwaJ3EzJwN

I think you should run ssh with debug running and post the diagnostics. I'm not sure how to do that with your client.

Also on the box, monitor /var/adm/syslog/syslog.log to see if there are any fun messages on the system during this process.

The Strong random number generator that you can install on 11i would be helpful to speed connections, but I believe that is still not an option for 11.00

sEP

[Marvin Strong]

Thats a windows client for ssh, is it not?

You could try to use ssh -v from a different unix machine (or even from that windows machine if you can use command line options) and look at the output, that might give you some ideas.

You could try to use a different unix machine to ssh to that machine multiple times also.

To figure out if its a client problem or not.
I suspect a client problem. Unless you really changed your sshd_config around.

[Mark Hopkins_6]

Yo Strong,

I think that I mentioned all of those suggestions in my original thread, did I not? To think that the client from SSH.COM is the issue is a bit of a stretch however I will try another client tonight. I suspect that it is a flaky depot/build. It amazes me as to the absolute ease of an open-ssh install on a Solaris 7,8,9,10 system. It seems as if there are no depot builds for HP-UX 11.0 and it certainly isn't as old as Solaris 7 or 8. Perhaps HP is trying to disuade me from using 11.0? Or perhaps I just don't know where to get a good bug-free ssh depot for HP-UX 11.0? Either is certainly a possibility. :) It looks as if I will have to build it "by hand". I would rather use swinstall, for its record keeping capabilities.

-Mark

PS - Remember Strong, don't drink the water at Jesters.

[Marvin Strong]

Yeah, no kidding next time, I'll just stick to alcohol.

I didn't see you mention ssh -v parsing?

Also if you can connect fine to every solaris server. What version of ssh are you running on the solaris machines is it the same everywhere? Or do you have multiple versions?

If you connect to the HP host from a solaris server does it work normally?

Unfortunately I don't know of any place to get a depot of ssh for 11.0 anymore.

Here is a link to the source if you think you need to compile it yourself. Probably a good idea, since it is probably newer than the version you have installed.

http://hpux.connect.org.uk/hppd/hpux/Networking/Admin/openssh-4.1p1/

[Mark Hopkins_6]

All:

What ever happened to the old public domain HP Software Depot? Is it still around or did HP put the kybosh on it?

Thanks.

-Mark

[Colin Topliss]

Hi,

The delay is most likely because its trying to do a name lookup on the incoming client connection. You should be able to stop that happening by setting the relevant option in sshd_config (useDNS I think off of the top of my head).

The error on the second attempt might be highlighted if you add the -v, or -vv option to the client login command line (as per Marvin's suggestion). You *might* be experiencing problems with the PAM modules.

Finally, I think that HP's SSH offering is based on OpenSSH. Tectia is a commercial version. I have had problems using the two together.

I ended up taking the latest version of OpenSSH and building it by hand (though this was for 11.11, not 11.0).

Col.

[Mark Hopkins_6]

Colin,

Thanks for the reply.

(1) As per my initial thread, I already disabled the DNS lookups.

(2) All of my Solaris installs are openssl/openssh and the Tectia client works perfectly, so I doubt that it is an incompatibility between OpenSSH and Tectia. More likely an incompatibility between HP-UX and Tectia.

(3) I will try the -v option later, after I have a beer. :)

(4) I probably should always "roll my own" when it comes to OpenSource products and not trust depots/packages/RPM's. I will probably go this route in the end. :)

I like HP-UX but I dislike and do not trust HP. Of course I could say the same about Solaris and Sun as well. :) :)

-Mark