Re: Another ssh problem - it looks up after a couple of minutes.

From: Laurent Blume (laurent=//=pas_de_pub/news200505_at_elanor.org)
Date: 08/28/05


Date: Sun, 28 Aug 2005 16:38:01 +0200

Dave wrote:
> I have a Sun Ultra 80 running Solaris 9 and ssh version (Sun_SSH_1.0)
> which is based on some variant of OpenSSH.
>
> Whenever I connect to another machine that has ssh running (including
> other Suns with other non-OpenSSH based servers), the connection locks
> up after a minute or two if not used. If its used, it keeps working.
>
> Any ideas what might be causing it to lock up if not used for a couple
> of minutes?

I never saw that behaviour, on lots of Sun and non-Sun systems. Which doesn't
help much, I know.
I have an SSH.com server not seeing correctly the idleness of the client.

> What I've tried/considered
>
> 1) I can't see any timeouts mentioned, other than
>
> LoginGraceTime 600

That shouldn't matter at all.

> in the sshd_config file of either machine.
>
> 2) KeepAlive yes
> is set in the /etc/ssh/ssh_config file
> (I'm not sure if that an OpenSSH command or not, but it is available on
> Suns).

It's an SSH protocol value, as far as I know.

> 3) I normally use tcsh, but have set up an accounts at both ends with
> /usr/local/bin/bash, and it still locks up.

Shouldn't matter.

> 4) I do allow direct root logins on one machine (yes I know it has its
> security risks) and it happens if logging in as root (/bin/sh, which is
> not the same as bash on a Sun) or as a normal user with /bin/tcsh

Sidenote:
It's not as risky as allowing telnet root, and not for the same reasons anyway.
It's only for the lack of accountability.
But it should not matter.

> 5) The local host has a firewall in the ADSL modem/router, but the
> timeout has been set >> than the time before the thing locks up.
>
> In one case, where a machine is on my local subnet, there is no firewall
> on that. In the other case, when I connect to my employers network,
> there is a firewall, but I have no idea how it is configured. But I had
> the problem long before there was any firewall there.

A firewall problem would be my first guess too. Is it possible for you to
activate logging of dropped packets on port 22?
I have seen a box with a firewall problem, that was resetting connections after
a while.
Also, snooping the connection on both sides to see where it hangs, and what is
the last packet sent.

Aaahh, something I've seen also, but a few years ago: the ISP was doing NAT, and
my public apparent IP address was changing after some time of inactivity. But it
was not as short as one minute.

> I've just thought of trying to run an X terminal on the remote machine,
> putting that into the background, and having a loop the prints the date
> every minute. I've not tried that one, but that is at best a poor hack
> even if it does work.

I'd advise first to use the screen command, available on the Companion CD or
other sources. You can configure it with a status line which does some traffic,
and even if the connection is lost, your session can be resumed at the same point.

Laurent



Relevant Pages

  • Re: Another ssh problem - it looks up after a couple of minutes.
    ... > Whenever I connect to another machine that has ssh running (including ... > other Suns with other non-OpenSSH based servers), ... > there is a firewall, but I have no idea how it is configured. ... Also, snooping the connection on both sides to see where it hangs, and what is ...
    (comp.unix.solaris)
  • Re: Another ssh problem - it looks up after a couple of minutes.
    ... > Whenever I connect to another machine that has ssh running (including ... > other Suns with other non-OpenSSH based servers), ... > there is a firewall, but I have no idea how it is configured. ... Also, snooping the connection on both sides to see where it hangs, and what is ...
    (comp.sys.sun.admin)
  • Re: I am having connectivity problems
    ... firewall and turned ON Windows firewall. ... When I tried to install SP2 I was unable to get it thru Windows Update. ... does the connection problem persist? ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Serious Security Issue in Windows XP SP2s Firewall
    ... Subject: AW: Serious Security Issue in Windows XP SP2's Firewall ... If you update a WinXP SP-1 with enabled Internet ... Connection Firewall ...
    (Focus-Microsoft)
  • RE: Serious Security Issue in Windows XP SP2s Firewall
    ... file and printer sharing is available for network login from any network (I ... Internet Connection Sharing of the PC has to be disabled." ... Serious Security Issue in Windows XP SP2's Firewall ...
    (Focus-Microsoft)