Walker News » Networking

How To Fix: SCP And SSH Login Prompt Is Very Slow In Linux

Walker — Mon, 06 Apr 2009 15:48:11 +0000

Apparently, today is not a good day for me. But it’s not too bad too as I still have enough fingers to count all these bad incidents :-)

OK, back to topic. How to find out that what cause the SSH or SCP login prompt to slowdown? How could you fix this so-called slow or delayed SSH and SCP login prompt?

This is one of the “bad incident” happened on me today – as the boss was looking at me to scp program patches to a remote Linux-based application server, the SSH login prompt took more than 1 minute to appear on screen.

To be precise, the stopwatch showed that it took exactly 1 minute and 25 seconds to display SSH login prompt!

Luckily, I do not have to Google for more than a minute to find the cause and solution :-)

What causes SCP and SSH login prompt to slowdown?

For my case, the GSSAPI authentication feature was causing the delayed SSH login prompt!

You can confirm the causes of your case by using the -v option switch. For example, the following is the verbose response of SSH login process started with -v option:

dev01 [/home/devstl]$ ssh -v appssupp@10.50.100.111
......
......
......
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-with-mic,password
debug1: Next authentication method: gssapi-with-mic
debug1: An invalid name was supplied
Cannot determine realm for numeric host address

debug1: An invalid name was supplied
Cannot determine realm for numeric host address

debug1: An invalid name was supplied
Cannot determine realm for numeric host address

debug1: Next authentication method: publickey
debug1: Trying private key: /home/devstl/.ssh/identity
debug1: Trying private key: /home/devstl/.ssh/id_rsa
debug1: Trying private key: /home/devstl/.ssh/id_dsa
debug1: Next authentication method: password
appssupp@10.50.100.111's password:

How to fix SCP and SSH delayed login prompt?

The answer for my case is apparently by disabling GSSAPI authentication, which can be done in one of these three ways:

The “fix” is tested with SSH clients installed by openssh-clients-3.9p1-8.RHEL4.15 RPM file.

1) Specify the option to disable GSSAPI authentication when using SSH or SCP command, e.g.:

ssh -o GSSAPIAuthentication=no appssupp@10.50.100.111

2) Explicitly disable GSSAPI authentication in SSH client program configuration file, i.e. edit the /etc/ssh/ssh_config and add in this configuration (if it’s not already in the config file):

GSSAPIAuthentication no

3) Create a file called config in .ssh directory of respective user home directory (or whichever user home directory that need to get rid of this show login prompt). For example, edit /home/devstl/.ssh/config (create the config file if it’s not currently exist) and add in the GSSAPIAuthentication no option.

1) /etc/ssh/ssh_config is a global SSH client configuration file that affects all system users who are using SSH client programs.

2) /home/devstl/.ssh/config is local SSH client configuration file that only affects the user account called devstl. Whatever SSH client options specified in this local file overwrite the options stated in global SSH client configuration file.

After disabling GSSAPI authentication, SSH login prompt is back to “normal” now:

dev01 [/home/devstl]$ ssh -v appssupp@10.50.100.111
......
......
......
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-with-mic,password
debug1: Next authentication method: publickey
debug1: Trying private key: /home/devstl/.ssh/identity
debug1: Trying private key: /home/devstl/.ssh/id_rsa
debug1: Trying private key: /home/devstl/.ssh/id_dsa
debug1: Next authentication method: password
appssupp@10.50.100.111's password:

As you can see, the SSH login is not currently authenticated via public key cryptography method, which I’ve to fix it later :-(

How To Restart VNC Server After VNC Service Hangs or Stops Unexpectedly?

Walker — Fri, 03 Apr 2009 10:32:55 +0000

How difficult is to restart the VNC server or service? Well, there is certainly no difficulty at all, if you’re in front of the server.

Now, imagine that server is at few hundred miles away and nobody is there to restart that bloody machine.

Worst still, simply reboot the machine might not able restart the VNC server.

So, what could you do in order to get the VNC server back to work? Precisely, if you can’t VNC to the remote server, how could you attempt to restart the VNC service?

OK, here are the tips and tricks for VNC server running in Windows or Linux machine.

To apply this method, however, there must be network connection between you and the remote server.

Restart VNC service of a remote computer running Windows 2000 or above

You must do the following steps on a computer running Windows 2000 or above as well. Let say this is a Windows Vista Ultimate machine.

1) Click the Vista Orb (Start button), right-click on Computer and select Manage option from the pop-up menu. This will open Computer Management window.

2) Right-click the Computer Management (Local), the top node on left pane, and select Connect to another computer….

Alternatively, click the Action menu to find the same option.

3) In the Select Computer dialog box, opt for Another Computer and type the computer name in the text box.

If you can’t remember the computer name, click Browse button follow by Advanced button and click Find Now to list all computers detected.

Now, hopefully this step will be succeed. Otherwise, it ends here :-(

Once you’ve connected the remote computer, click Services and applications node on the left pane of Computer Management window. From there, locate the VNC service on the right pane and restart it.

Restart VNC service of a remote computer running Red Hat Enterprise Linux

With Linux, this job is easier :-)

Other than network connection, you must able to remotely login the Linux server, be it the vulnerable telnet or secure SSH protocol.

After login to Linux command prompt (via telnet or SSH), just execute service vncserver restart, if the VNC server is configured to auto-start when Linux boots up / reboot.

If there is no auto-start setup, then do the manual ways as you’ve done:

1) If the VNC server process stills exists, and it was started with DISPLAY:1, then kill it will command vncserver -kill :1

2) Start it again by executing vncserver :1

Now, you can confirm the VNC server is up again by executing netstat command:

netstat -tulpan | grep vnc

If the VNC server is started for DISPLAY:1, the netstat result should shows Xvnc listening to three different ports: 5801, 5901, and 6001.

How To Allow Root Login To Telnet Server In Linux?

Walker — Tue, 17 Mar 2009 17:15:23 +0000

Although remote access via telnet protocol is highly discouraged by most system administrators, there are still fans and old boys who are reluctant to change.

Interestingly, these people (who I’ve been dealing with) are all Windows users, i.e. they either use Windows at most of the time or they never have their hands on Linux at all.
So, I guess these people will only abandon telnet client when Microsoft start to bundle Secure Shell (SSH) clients with Windows OS :-(

Now back to topic, if you really want to put the Linux host at risk by allowing telnet protocol, here is the way to enable telnet server in Red Hat Enterprise Linux system (in case you’re asking).

Next, we look at How to enable root account telnet to Red Hat Linux system, if you have nothing to worry about system security (because you’re sysadmin, not security administrator :-)

Telnet client transmit account password in plain text format over (vulnerable) network. Thus, by default, Red Hat Linux (and most Linux distributions, I believe) disables telnet daemon and disallow root user to login directly via telnet protocol.

When you telnet to RHEL server with root ID, it will always rejects with message saying “Login incorrect”, no matter how many times you’ve entered the correct root password:

To overcome this “problem”, simply open /etc/pam.d/remote and remark this following line, where the PAM module pam_securetty.so disallows root user login remotely via telnet and the alike (except SSH).

Original /etc/pam.d/remote with this line:

auth       required   pam_securetty.so

Tweaked /etc/pam.d/remote that remark (comment out) pam_securetty.so:

# auth       required   pam_securetty.so

This guide has been tested successfully on system running RHEL4. It should be valid for use in other Linux distributions that implement Linux-PAM modules (Pluggable Authentication Modules for Linux).

How To Fix Telnet Rejection Error of Name or Service Not Known: Illegal Seek

Walker — Wed, 19 Nov 2008 17:16:08 +0000

We all know that telnet is a good remote access protocol in the old days. Now, we prefer SSH protocol because SSH is a secure protocol, i.e. it’s not easy to hack.

However, for some reasons, telnet server still installed for some (Microsoft Windows) users who desperately need remote access facility. (Maybe telnet server will go into history when Windows start to bundle Putty or its own SSH client).

So, this is what happen here, that we have to install and enable the insecure telnet server on all Red Hat Enterprise Linux servers, for obvious reason.

Problem happen today when one user reported that he cannot telnet to the server, with an rejection error message that said “GetAddrInfo: : Success. Name or service not known: Illegal seek” (as seen in the following screenshot taken when I telnet to localhost in a SSH session):

How to fix this so-called “Name or service not known: Illegal seek” error (replied by the telnet daemon)?

Well, I guess this has something to do with DNS resolution. It was working fine until we changed the Linux hostname on yesterday. The hostname is not registered to DNS servers that defined in /etc/resolv.conf file and there is no hostname-to-IP mapping in /etc/hosts file as well.

So, to try out the possible solution, I add in hostname-to-IP mapping in /etc/hosts file, and it works:

192.168.20.21      WalkerNews      WalkerNews.net

[ assuming the hostname is WalkerNews and its IP address is 192.168.20.21]

I am not sure (because I haven’t tried) the problem will be fixed, if I remove the hostname-IP mapping in /etc/hosts and register the hostname-IP to DNS servers that defined in /etc/resolv.conf file. (I bet this will work, too).

Windows Vista Multiple Networks: Wireless To Public WIFI and Wired To Private LAN

Walker — Tue, 28 Oct 2008 17:51:47 +0000

Today, I found an insecure public WIFI in office that allows me to surf Internet directly (without going through the corporate proxy server).

As Dell Latitude D410 built with both Ethernet and wireless network connection, so I would like the wireless network adapter connecting to Internet via that insecure public WIFI and use the wired Ethernet network to access corporate network.
However, soon after I plug in CAT-5 cable to Ethernet port, the Windows Vista Multiple Networks failed to access Internet via public WIFI connection.

How to configure Windows Vista SP1 Multiple Networks so that only the wireless is used to connect to Internet and use the Ethernet LAN connection to access corporate / internal network?

^{How to configure Windows Vista Multiple Networks - use wireless to connect Internet and wired Ethernet to access internal LAN network?}

In my case, both the Ethernet LAN connection and Wireless network connection has a default route 0.0.0.0. However, the Ethernet LAN connection always given a lower route metric than the wireless network connection. (Is it the faster network interface prioritized for lower metric?)

Thus, all network packets addressed to Internet IP forwarded to Ethernet network interface rather than to the wireless network connection, which has a higher route metric.

Solution: There might be a better solution, but I choose to delete the default route of Ethernet network interface from route table.

Configure Windows Vista Multiple Networks – Delete Unwanted Default Route 0.0.0.0

While ONLY the wireless network interface is connecting to that insecure public WIFI, execute route print in an elevated Command Prompt window shows there is only one active network interface (i.e. 192.168.0.103) and its default route (0.0.0.0.):

^{Windows Vista route print command display the route table information - the Interface List and Route Table.}

Now, after connecting the Ethernet port to corporate network via CAT-5 cable, the route table has two active networks interface and their respective default route (but different metric, i.e. 20 and 25):

^{Windows Vista route table with multiple default routes.}

So, I have to delete / remove the default route of Ethernet network interface:

route delete 0.0.0.0 IF 11

where the IF 11 refers to Inteface List # 11 (which is displayed by route print command output, in the Interface List section).

In my example (2nd screenshot), the IF 11 refers to Broadcom Nextreme 57xx Gigabit Controller (as highlighted with blue color) while IF 12 is the wireless network interface that appears as Intel (R) PRO/Wireless 2200BG Network Connection.

At this point, I’m happily browsing any web sites without restriction (oppose to web browsing through corporate proxy server with WebMarshal filtering feature) via wireless network interface that connecting to public WIFI.

At same time, I am able to access MS Exchange Server and all other corporate network resources using the faster Ethernet LAN connection. (Although, I’ve to add some routes with different gateways to access the 192.x.x.x segments, which is part of the corporate networks).

Private IP VS Public IP: How To Check WAN IP, Public IP, or Internet IP?

Walker — Mon, 25 Aug 2008 16:44:15 +0000

15 years ago, your home computer might not really need an IP address, simply because you neither online to Internet nor connected to a local network.

Nowadays, an offline Core 2 Duo computer is like a Jaguar without fuel to burn for power!

Having say that, 99% of home computers (be it a Desktop or Laptop, Core 2 Duo or an aging Pentium 133) have been actively using IP address to communicate over the TCP/IP network.

Private IP vs Public IP

In a brief, using a home computer network as an example, a private IP is an unique ID used to facilitate communication among IP-enabled devices (network printer, laptop, XBox, etc) that linked up to the same ADSL router modem. The ipconfig command in Windows or /sbin/ifconfig command in Linux can be used to check this private IP address.

In contrast, public IP (a.k.a. WAN IP or Internet IP address) is an unique ID given by your Internet service provider (ISP) to the ADSL router modem, enable it to online to Internet.

In a office/college network, the Desktop/laptop hooking up to the internal network is using a private IP too, be it fixed IP or dynamic IP given by internal DHCP server. The proxy server that serves Internet-related activity is in turn holding the public, WAN IP address given by ISP.

How to check my public/Internet/WAN IP address?

There are many ways lead to Rome. Here are just some of the easy methods to check my computer (or your computer) WAN IP/Public IP/Internet IP:

Just ask Google Search to look for “check WAN IP”, “check public IP”, etc. For example, one of the easiest URL to remember could be who.is. Just type who.is in the web browser and hit ENTER key, a simple and quick-loading webpage appears with a line that says Your IP is xxx.xxx.xxx.xxx.
Telnet to ADSL router modem (e.g. D-LINK 504T) and type ifconfig to check inet addr of ppp0.
Add this Google gadget to your iGoogle homepage/blog. You could also simply click this link to view your WAN IP address, hostname given by the ISP, ISP name, country name and proxy server information.

Configure VNC Server To Auto Start Up In Red Hat Linux

Walker — Fri, 20 Jun 2008 09:08:38 +0000

Last year, I wrote a post on how to configure VNC server in Red Hat Linux system. But, that 3-minutes setup guide doesn’t mention about how to auto start VNC server when Linux boots up.

Again, don’t expect this is a complex setup. Indeed, you probably need less than a minute to get this job done!
How to auto start VNC server in Red Hat Linux after system reboot?

My testing environment is a machine running on Red Hat Enterprise Linux 4 Update 4, with the bundled VNC Server (i.e. vnc-server-4.0-8.1). Also assume that a Linux user account called “walker” needs the VNC server to start up automatically when Linux boots up.

The Linux user account that needs VNC server to automatically start up after system reboot, must have a VNC password. To create a new (or reset a forgotten) VNC password, just login or su (switch user) with that Linux user account and execute this simple command:
```
vncpasswd
```
Enter a password when prompted, which is used for VNC authentication.
A hidden directory named .vnc is created in the user home directory by the vncpasswd command (if it’s not current exists). Execute ls -la $HOME/.vnc command to check if there is a file called xstartup. If this file is not exists, bring up VNC server with another simple command:
```
vncserver :1
```
If you get this similar message “A VNC server is already running as :1″, meaning that there is another instance of VNC server running with the same display number. To resolve this, just try to replace the :1 with :2, :3, etc. Alternatively, you may execute this netstat command with root user privilege:
```
[root@walkernews ~]# netstat -tulpan | grep vnc
tcp    0    0 0.0.0.0:5801    0.0.0.0:*   LISTEN   3402/Xvnc
tcp    0    0 0.0.0.0:5802    0.0.0.0:*   LISTEN   8447/Xvnc
tcp    0    0 0.0.0.0:5901    0.0.0.0:*   LISTEN   3402/Xvnc
tcp    0    0 0.0.0.0:5902    0.0.0.0:*   LISTEN   8447/Xvnc
tcp    0    0 0.0.0.0:6001    0.0.0.0:*   LISTEN   3402/Xvnc
tcp    0    0 0.0.0.0:6002    0.0.0.0:*   LISTEN   8447/Xvnc
```
The netstat output shows that there are two VNC servers running with display number 1 and 2. So, for the 3rd VNC server to start, the command should be vncserver :3.
Edit $HOME/.vnc/xstartup file with your favourite editor, to un-comment these two lines in order to get the “normal” Linux Desktop view:
```
unset SESSION_MANAGER
exec /etc/X11/xinit/xinitrc
```
Switch user to root account (i.e. su - root), edit /etc/sysconfig/vncservers with your favourite editor, append the display number and Linux user account information to the VNCSERVERS (an array variable). This configuration file defines who can start up VNC server with what display number via the VNCSERVERS array (that’s read by Linux start up scripts /etc/init.d/vncserver). For example,
```
VNCSERVERS="1:root 2:tester 3:walker"
```
That means there are three Linux user accounts (root, tester, and walker) will start up VNC server with display number 1, 2, and 3 respecitively, as Linux boots up.

Note: Don’t simply add more than one VNCSERVERS array in /etc/sysconfig/vncserver configuration file. Otherwise, only the last VNCSERVERS array will be used.
Make sure VNC server (the daemon or server process) is set to auto run upon system boots up to your runlevel. For example,
```
[root@walkernews ~]# chkconfig ––list | grep vnc
vncserver  0:off  1:off  2:off  3:off  4:off  5:on  6:off
```
The ––list option of chkconfig shows VNC server is set to auto run in Linux runlevel 5 (the default multi-user runlevel with Linux Desktop console). To configure VNC server to auto run when Linux boots into runlevel 5, use the ––level with on option switch:
```
chkconfig --level 5 vncserver on
```

Ok, that’s all you need. You should have the VNC server automatically running when Red Hat Linux boots up at runlevel 5. Although the guide might looks lengthy to you, but works involve shouldn’t take you more than 3 minutes after you get used with Linux!