Re: Strange sshd behaviour

[Paul Goyette <paul%whooppee.com@localhost>]

On Thu, 22 Jan 2009, Steven M. Bellovin wrote:

> How long do you wait?  Often, long but not infinite delays are due to
> DNS lookup issues.

The tcp session gets established without problem, so the only thing that 
might be DNS-related would be some reverse-DNS lookup from the target's 
sshd.  A quick check from an attempt to log in more than 30 minutes ago 
shows the sshd processes still sitting there, while the tcp session is 
properly established _and_ a reverse-DNS lookup to the source works:

quicky:paul {125} netstat -afinet | head
Active Internet connections (including servers)
Proto Recv-Q Send-Q  Local Address          Foreign Address        State
tcp        0      0  localhost.x11          localhost.65004        ESTABLISHED
tcp        0      0  localhost.65004        localhost.x11          ESTABLISHED
tcp        0      0  localhost.x11          *.*                    LISTEN
tcp        0      0  quicky.ssh             nat-service4.jun.30782 ESTABLISHED
tcp        0      0  quicky.shilp           zippy.1015             ESTABLISHED
tcp        0      0  *.x11                  *.*                    LISTEN
tcp        0      0  localhost.dyna-access  *.*                    LISTEN
tcp        0      0  localhost.10026        *.*                    LISTEN
quicky:paul {126} ps auxw | grep sshd
root      306  0.0  0.1  292   2136 ?      Is   11:48AM 0:00.27 /usr/sbin/sshd
paul     7244  0.0  0.1  344   3540 ?      I     6:05PM 0:00.00 sshd: paul@notty
root     9537  0.0  0.1  344   4768 ?      Is    6:05PM 0:00.02 sshd: paul 
[priv]
paul    10852  0.0  0.0  112     48 ttyp0  R+    6:37PM 0:00.00 grep sshd
quicky:paul {127}

-------------------------------------------------------------------------
|   Paul Goyette   | PGP DSS Key fingerprint: |  E-mail addresses:      |
| Customer Service | FA29 0E3B 35AF E8AE 6651 |  paul at whooppee.com   |
| Network Engineer | 0786 F758 55DE 53BA 7731 | pgoyette at juniper.net |
|                  |                          | pgoyette at netbsd.org  |
-------------------------------------------------------------------------