What is the Fastest Authentication Protocols for SSH

[Shah Sahib]

Ok experts, sorry if I did not word my subject line correctly but we are having problems with SSH login hanging for long time. We want to see if we can use some other authentication protocol other than PAM or Kerberos.

Ok, I am not a security expert so dont flame me, just let me know what should we use for light security as most of the connections pass encrypted data from remote programmes and batch jobs etc, so we dont need to double encrypt, I am thinking this is the problem, sorry for not providing more info, but let me know what the consensus is.

TIA

[Ivan Krastev]

Check your DNS resolvin. This is a commong issue with slow logins via ssh.

Disable dns in sshd_config:

UseDNS no


regards,
ivan

[Patrick Wallek]

What version of HP-UX are you running? Are you running some sort of random number generator?

For HP-UX 11.11 (11i v1) and higher you can install the KRNG (Kernel random number generator) package and that helps authentication speed immensely.

[Dave Hutton]

Kind of a long what Patrick was saying. I know for 10.20 -> 11.00 the larger your /var/adm/wtmp and btmp files get the longer it takes for your connection to go. If you are running the older versions of OS you could try to zero out those files and try it.

[Shah Sahib]

Guys we are running HPUX 11.23 on a ia64 box, with Secure_Shell A.04.10.005, i dont see a RNG installed...the DNS is fine.

Will look into btmp and wtmp cleanup.
thanks

[TwoProc]

Just for giggles add the ip address of whatever developer's machine is slow to login from into the /etc/hosts file. Retry the ssh login - if it's now fast, then it's dns speed issues.
I saw recently a suggestion to speed this up, and it was to make your machine a downstream end-level dns resolver, that way you'll have all that stuff cached up and close by on your own server, and you won't have to wait for a resolution... or you can just add developer's IP addresses to your /etc/hosts file - doesn't hurt anything...

[IT_2007]

post your /etc/nsswitch.conf file

also post sshd_conf file.

so that we can verify.

[skt_skt]

is the login working fast through telnet?

Then update sshd_config as below,


UsePrivilegeSeparation no
#Compression yes

[Shah Sahib]

I will respond to other questions, but here is the nsswitch.conf file

[Shah Sahib]

I shared all the responses from this forum with our team here and they were all very good, my immediate question is (Patrick?) how do i find out what version RNG we are using? Is it integrated into some product? any detail on that is helpful, and twoproc we cant use the hosts file as we have dns and ldap setup but yes that would be good for testing and we will if all else fails, Dave yes I will clean up the wtmp and btmp soon as someone in the meeting agrees with you on that, Santosh thanks I verified it was already set to what you recommend.

[Shah Sahib]

I did a ssh -vvv verbose login on the server and noticed the line

:RNG is ready, skipping seeding
:sh_connect: needpriv 0

does this mean anything?

[skt_skt]

the delay is expeted if the wtmp is too big; Compare the size with other machine (is it really bigger).

Here is the procedure to do that..(tested)

1. Ensure that the wtmp file is not corrupt by running a last on your user id:

# last ` who am i `

2. Convert the wtmp file to ascii into a file system that has sufficient space:

# cat /var/adm/wtmp | /usr/sbin/acct/fwtmp > /tmp/ascii_wtmp

3. Determine the number of lines in the ascii file, take 10% of that value, and subtract that from total number of lines:

# lines=`cat /tmp/ascii_wtmp | wc -l`;lines2=`expr $lines / 10`; export lines3=`expr $lines - $lines2`;echo $lines3

4. Start the ascii file from the line number given as output from the above command:

# awk ' ( NR > '$lines3' ) ' /tmp/ascii_wtmp > /tmp/ascii_wtmp2

5. Convert the trimmed ascii file back to binary in place of the original wtmp:

# cat /tmp/ascii_wtmp2 | /usr/sbin/acct/fwtmp -ic > /var/adm/wtmp

6. Verify that the operation was successful

# ll /var/adm/wtmp

# last ` who am i `

[Shah Sahib]

I just blew away the wtmp file, we dont need wtmp or btmp as it is a security risk anyways. I will monitor if the login improved.

But i notice we also have a file "wtmps" in the same dir as wtmp and it is large over 78mb..what is that?

Secondly, since we are on 11.23 so we should have a Random Number Generator built in, but my question is how do i know its running or being used? thanks

[Dave Hutton]

I know you posted ssh -vvv and connected. You could also try running the sshd deamon in debug. sshd -ddd I've only messed with it a little when I was having issues, it seems like its only good for 1 session. (I couldn't figure out to allow it to have more then 1, but didn't spend much time on it)

So at least you could watch the origination and destinations and see where it gets hung up.

I've never had any issues with speed on 11.11 or newer. I only mention the wtmp/btmp because we do have some old 11.00 servers that when those files grow it tends to slow things down. I'm assuming it uses those files to randomly seed your connections. But if it helps great. I would just be surprised if it did.

[skt_skt]

Secondly, since we are on 11.23 so we should have a Random Number Generator built in, but my question is how do i know its running or being used?

watch the screen (RNG is ready, skipping seeding)

#tusc -Eeaf -p -v -rall -wall -vall -T '' -o /tmp/ssh_tusc.txt ssh -vvv root@localhost

[Shah Sahib]

Thanks Santhosh, tusc seems to be a good tool, we dont have it yet but will look into it.

[Shah Sahib]

thanks to all.