SSHD Problem

Hello
Recently I have installed FreeBSD about 10x so far, 11.3 and 12.1, and they both are acting strange. On all the installs besides one (I saved that one) when I ssh (putty) to the BSD box they hang for 15-20s.
11.3 - after I enter 'root' and press enter, it takes 15-20s for sshd to reply with a 'using plain-text password...' prompt.
12.1 - when I 1st putty to the sshd box, it takes 18-22s for sshd to reply with a username prompt. But it does reply quickly after I enter the username.

So they both (besides one box, same brand, same model, same memory) hang but in different places.

In both cases there is something going on I haven't been able to figure out, after 3 days of looking. I wiresharked it all, and on 11.3, I find:
GOOD BOX (<1s)
- ssh client sends ssh-request
- sshd replies with ssh-reply
and so on...
BAD BOX (15-20s)
- client sends ssh-request
- sshd replies with ack but NO ssh-reply for 15-20s
and so on...

Originally i was thinking that sshd is waiting for radius or tacacs to timeout, but I've checked the cfgs between the good PC and all the bad ones (3 PCs different installs) and I find nothing, and I never installed radius. The installs are supposed to be the same.
 
This sort of thing can be DNS, so I'd check the DNS.

Anything different between the working machine and the non-working machine in terms of DNS?
 
I would guess dns, reverse lookup. Seen it plenty of times.
Some ways to fix it:

In /etc/ssh/sshd_config:
#UseDNS yes
change to:
UseDNS=no

Or: Add reverse PTR record to dns for your workstation.

Or: add the ip address of your workstation to /etc/hosts.
 
Yup, you're correct B, I found the fix last nite late. The issue was, there never was a DNS server set up, but I added one anyways during setup partly because I wanted to see what resulted after the install. Same deal with IPv6. I also removed PAM (making room for Kathy :) while fixing it. I'm off to post a msg re Vi now...
 
Oh yes, if it matters, it seems 12.1 and 11.3 FBSD act differently, as they must have changed the time that the recverse lookup is done. In 12.1 it seems to be done very early in the code, in 11.3 it's done after the user enters their name. More security they'll claim.
 
Back
Top