Strange SSH / SSHD behavior [RESOLVED]

hitman200ca · Last edited by hitman200ca on Fri May 21, 2004 12:31 am; edited 1 time in total

I am running SSHD on my Gentoo box and have poked out port 22 in my firewall.
I am able to connect to it and log in as any user however after a short period
it will freeze up when running commands. For example.

hex4def6 · Posted: Thu May 20, 2004 4:12 pm Post subject:

hmm..

Is this a reliable network connection (ie - cat5 vs wifi, etc). Perhaps the link is dropping packets and screwing up the connection.

On the idea that its a dodgy connectinon: try pinging the box and seeing the number of dropped packets.

hitman200ca · Posted: Thu May 20, 2004 4:41 pm Post subject:

I have an excellent connection to the box.

It is on DSL and I am at work which provides a huge pipe
(university). I tried the ping test with 50 packets. No dropped
packets and replies are less than 100ms.

The box is also a router so I will try this from my internal network
tonight after work. I don't think its a firewall issue since port 22
is wide open.

Another wierd issue. I can run a regular ls in a directory with few files
and it finishes no problem but if I go into /etc and do an ls it gets out
about 10 lines then freezes. It must have something to do with ssh's
output buffer or something. (Grasps at straws)
_________________
"Against stupidity, the Gods themselves contend in vain."
-- Friedrich von Schiller

MagicMonkey · n00b Joined: 17 Dec 2003 Posts: 37 Location: UK

Is it a consistent problem, ie does it always stop after the same ten lines, or do you get slightly differing results each time? I ask because I've had random problems before, and it turned out to be a slightly faulty memory module. I assume it didn't freeze the whole machine either because I was lucky, or because the kernel keeps itself in lower memory areas. I'm just guessing though...

hitman200ca · Posted: Thu May 20, 2004 5:25 pm Post subject:

It is not exactly random either.

I can run a thousand ls / 's which only write out one line to the
console. But if I try ls /etc I always get 10 lines and ls -R /etc
is always only 2 lines. netstat -an is always 2 lines etc.

I have tried using different clients on different machines to the
same effect.
_________________
"Against stupidity, the Gods themselves contend in vain."
-- Friedrich von Schiller

hitman200ca · Posted: Thu May 20, 2004 11:24 pm Post subject:

UPDATE)

I have a Fedora Core 2 box behind my Gentoo router and I can ssh in no problem
and all command work without error. There are two possibilities at this point (that
are obvious anyway) The first is the since the connection is slower over the internet
something to do with the buffer is messing up when it sends the commands response.

Or

My firewall setting are screwing up the connection midway ??? This sounds quite
improbable. I'm off to try googling this issue.
_________________
"Against stupidity, the Gods themselves contend in vain."
-- Friedrich von Schiller

hitman200ca · Posted: Thu May 20, 2004 11:54 pm Post subject:

UPDATE 2)

I found out partially what is going on but as for what is ACTUALLY going on I
have no idea. I cut out a bunch of extraneous log messages generated by my
firewall script that where just getting in the way. Afterward I run a test and found
this

hitman200ca · Posted: Fri May 21, 2004 12:12 am Post subject:

UPDATE 3) Yet another reply to myself

OK so the iptables log messages are ICMP error packets that specify that
fragmentation is needed to send the data. This makes sense because it
only happens when the command generates a lot of info on the console.

How do I enable packet fragmentation? Or is there something else
that needs to be done to fix this? Something with the MTU ?
_________________
"Against stupidity, the Gods themselves contend in vain."
-- Friedrich von Schiller

Chris W · Posted: Fri May 21, 2004 12:32 am Post subject:

If you are using Roaring Penguin PPPOE you could look at the CLAMPMSS option. Alternatively, you should allow ICMP Dest Unreachable (Fragmentation Needed) (ICMP Type 3 Code 4) packets in to your machine so that the system can act on them in the intended fashion.
_________________
Cheers,
Chris W
"Common sense: The collection of prejudices acquired by age 18." -- Einstein

hitman200ca · Posted: Fri May 21, 2004 12:37 am Post subject:

SOLUTION)

Finally I found out what is wrong. It is surprising that this doesn't happen to
more of us since most of the iptables tutorials block this by default.

The issue is that when the client executes a command that generates a lot
of console output the server sends a larger packet to the client which the
client may not accept (based on MTU size). In my case the default MTU
is 1492 which is set somewhere, possibly in my DSL router.

So the gateway sends back an ICMP error fragmentation needed packet for
every transfered packet which registers in iptables as INVALID and in my setup
is dropped. Thus the server doesn't know that the packet should be fragmented
and the client is kept waiting, something the ssh protocol doesn't handle gracefully.

So to fix this issue you must add some lines to your FW script.