Remote Access Problems

[Gareth Crispin]

I'm running Solaris 9, on an dual processor Enterprise 250. I'm using
Sunscreen firewall to protect the server (however it is at the moment
allowing all common services while I trouble shoot the box).

If I log into the box using SSH, it accepts my user name and password - then
hangs for around 20-25 seconds before giving me a shell prompt. During this
time, if I hit ctrl-c it gives me access to my shell immediately.

After this nonsense, I can work happily for about 5-10 minutes then my SSH
session locks up and dies.

I've ruled out the physical connection to network, as I've used a different
port / cable on the hosting switch, and it still does the same. Also, DNS is
working and happy, so it can resolve the address of the incoming
connection - this isn't the cause of the delay.

Where should I start?

Thanks in advance
Gareth Crispin
DCS Engineer

[Martin Schoen]

Gareth Crispin wrote:

> I'm running Solaris 9, on an dual processor Enterprise 250. I'm using
> Sunscreen firewall to protect the server (however it is at the moment
> allowing all common services while I trouble shoot the box).
>
> If I log into the box using SSH, it accepts my user name and password - then
> hangs for around 20-25 seconds before giving me a shell prompt. During this
> time, if I hit ctrl-c it gives me access to my shell immediately.

Prevent your box (sshd) from doing identd-requests for incoming
connections. You might do this by configuring ssh-daemon, or reject
those requests on your firewall (*reject* (which means e.g.
icmp-service-not-available), don't silently drop them, because this
would lead to the same situation as before, you have to wait for your
login until the ident request time out).

> After this nonsense, I can work happily for about 5-10 minutes then my SSH
> session locks up and dies.

This mght, too, be a configuration either of your sshd or the in between
firewall. Don't know Sunscreen, but others do have a preset limit for
certain services.

Does this happen only if you're idle, or with 'working' connections too?

> I've ruled out the physical connection to network, as I've used a different
> port / cable on the hosting switch, and it still does the same. Also, DNS is
> working and happy, so it can resolve the address of the incoming
> connection - this isn't the cause of the delay.

Instead of rejecting ident, you can insert lines to your hosts file for
each allowed client (if you can name them, and they don't vary).

Check your /var/adm/messages (auth, ...) for entries while trying to
connect. This should give hints...


hth

Martin