| View previous topic :: View next topic |
| Author |
Message |
ercete
Guru
Joined: 11 Dec 2003
Posts: 426
Location: France, Avignon
|
 Posted: Fri Dec 09, 2005 9:58 am Post subject: [SSH] Double ssh et timeouts inévitables |
 |
|
Salut,
J'ai deux ssh,
ma distrib est gentoooooo 
Dans mon /etc je trouve
| Code: |
drwxr-xr-x 2 root root 376 déc 9 10:45 ssh
drwxr-xr-x 5 root root 408 nov 3 12:39 ssh2
|
| Code: | courgette etc # l ssh*
ssh:
total 168K
-rw-r--r-- 1 root root 130K oct 24 23:51 moduli
-rw-r--r-- 1 root root 1,3K oct 24 23:51 ssh_config
-rw------- 1 root root 2,8K déc 9 10:45 sshd_config
-rw------- 1 root root 2,8K déc 9 09:08 sshd_config~
-rw------- 1 root root 668 oct 15 00:46 ssh_host_dsa_key
-rw-r--r-- 1 root root 604 oct 15 00:46 ssh_host_dsa_key.pub
-rw------- 1 root root 529 oct 15 00:46 ssh_host_key
-rw-r--r-- 1 root root 333 oct 15 00:46 ssh_host_key.pub
-rw------- 1 root root 887 oct 15 00:46 ssh_host_rsa_key
-rw-r--r-- 1 root root 224 oct 15 00:46 ssh_host_rsa_key.pub
ssh2:
total 44K
-rw------- 1 root root 1,4K oct 3 12:55 hostkey
-rw-r--r-- 1 root root 1,2K oct 3 12:55 hostkey.pub
drwxr-xr-x 2 root root 48 oct 3 12:55 hostkeys
drwxr-xr-x 2 root root 48 oct 3 12:55 knownhosts
-rw-r--r-- 1 root root 2,4K oct 3 12:55 ssh2_config
-rw-r--r-- 1 root root 2,4K oct 3 12:55 ssh2_config.example
-rw------- 1 root root 6,1K nov 3 12:39 sshd2_config
-rw------- 1 root root 6,1K oct 3 12:55 sshd2_config~
-rw-r--r-- 1 root root 6,1K oct 3 12:55 sshd2_config.example
-rw-r--r-- 1 root root 122 oct 3 12:55 ssh_dummy_shell.out
drwxr-xr-x 2 root root 184 oct 3 12:55 subconfig
|
Mmmm... le contenu a l'air différent, mais l'un des deux ne serait il pas en trop ?
Quoi qu'il en soit, lorsque je lance | Code: | | /etc/init.d/sshd start |
ça marche,
chouette !
mais au bout d'une dizaine de minutes, j'obtiens un timeout...
j'ai modifié certaines options de /etc/ssh/sshd_config :
| Code: |
TCPKeepAlive yes
# [...]
ClientAliveInterval 0
ClientAliveCountMax 99
|
Mais ces valeurs ne semblent pas bonnes et j'aimerais bien savoir quoi mettre...
_________________
Oh look... is it a stockbroker? Is it a quantity Surveyor? Is it a church warden?
NO! It's Bicycle Repair Man!
jadis raoulchatigré |
|
| Back to top |
|
 |
nico_calais
l33t
Joined: 09 Jun 2005
Posts: 628
Location: Saint Julien en Genevois
|
| Posted: Fri Dec 09, 2005 11:59 am Post subject: |
|
|
J'ai laissé en commentaires les 3 paramètres que tu cites.
Je n'ai pour ma part aucun problème de timeout en ssh.
Est-ce que tes timeout ont lieu uniquement en periode d'inactivité sur ta console ssh ou cela a lieu tout le temps ?
_________________
"Unix IS user friendly... It's just selective about who its friends are." Tollef Fog Heen tollef@add.no |
|
| Back to top |
|
|
ercete
Guru
Joined: 11 Dec 2003
Posts: 426
Location: France, Avignon
|
| Posted: Fri Dec 09, 2005 12:11 pm Post subject: |
|
|
seulement en période d'inactivité,
à noter que j'utilise putty sur un poste Windows au travail pour accéder à ma machine linux à la maison.
voilà mon sshd_config en entier :
| Code: |
courgette ssh # cat sshd_config
# $OpenBSD: sshd_config,v 1.72 2005/07/25 11:59:40 markus Exp $
# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.
# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options change a
# default value.
#Port 22
Protocol 2
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::
# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key
# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
#ServerKeyBits 768
# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
#LogLevel INFO
# Authentication:
#LoginGraceTime 2m
#PermitRootLogin yes
#StrictModes yes
#MaxAuthTries 6
#RSAAuthentication yes
#PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes
# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication no
#PermitEmptyPasswords no
# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication mechanism.
# Depending on your PAM configuration, this may bypass the setting of
# PasswordAuthentication, PermitEmptyPasswords, and
# "PermitRootLogin without-password". If you just want the PAM account and
# session checks to run without PAM authentication, then enable this but set
# ChallengeResponseAuthentication=no
UsePAM yes
#AllowTcpForwarding yes
#GatewayPorts no
#X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#Compression delayed
ClientAliveInterval 0
ClientAliveCountMax 0
#UseDNS yes
#PidFile /var/run/sshd.pid
#MaxStartups 10
# no default banner path
#Banner /some/path
# override default of no subsystems
Subsystem sftp /usr/lib/misc/sftp-server
|
Voyons les valeurs par défaut si je commente...
_________________
Oh look... is it a stockbroker? Is it a quantity Surveyor? Is it a church warden?
NO! It's Bicycle Repair Man!
jadis raoulchatigré |
|
| Back to top |
|
|
nico_calais
l33t
Joined: 09 Jun 2005
Posts: 628
Location: Saint Julien en Genevois
|
| Posted: Fri Dec 09, 2005 12:20 pm Post subject: |
|
|
Voila le mien. J'ai noté quelques différences.
J'utilise aussi putty pour accéder à ma gentoo.
Good luck 
| Quote: | Port 22
#Protocol 2
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::
# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key
# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
#ServerKeyBits 768
# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
#LogLevel INFO
# Authentication:
LoginGraceTime 2m
PermitRootLogin yes
#StrictModes yes
MaxAuthTries 6
#RSAAuthentication yes
#PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication no
#PermitEmptyPasswords no
# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication mechanism.
# Depending on your PAM configuration, this may bypass the setting of
# PasswordAuthentication, PermitEmptyPasswords, and
# "PermitRootLogin without-password". If you just want the PAM account and
# session checks to run without PAM authentication, then enable this but set
# ChallengeResponseAuthentication=no
UsePAM yes
#AllowTcpForwarding yes
#GatewayPorts no
#X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS yes
#PidFile /var/run/sshd.pid
#MaxStartups 10
# no default banner path
#Banner /some/path
# override default of no subsystems
Subsystem sftp /usr/lib/misc/sftp-server |
_________________
"Unix IS user friendly... It's just selective about who its friends are." Tollef Fog Heen tollef@add.no |
|
| Back to top |
|
|
ercete
Guru
Joined: 11 Dec 2003
Posts: 426
Location: France, Avignon
|
| Posted: Fri Dec 09, 2005 12:24 pm Post subject: |
|
|
Je remarque que chez toi le "protocole 2" est commenté.
Donc tu dois utiliser une ancienne version du protocole ssh et moi une nouvelle.
C'est peut-être une différence importante.
Sinon j'ai regardé brièvement le contenu de /etc/sshd2_config
mais j'y ai pas trouvé mon bonheur...
Je suis un peu perdu parmi ces configs ssh, personne d'autres n'aurait déjà roulé sa bosse sur le sujet par hasard ?
_________________
Oh look... is it a stockbroker? Is it a quantity Surveyor? Is it a church warden?
NO! It's Bicycle Repair Man!
jadis raoulchatigré |
|
| Back to top |
|
|
El_Goretto
Moderator
Joined: 29 May 2004
Posts: 3169
Location: Paris
|
| Posted: Fri Dec 09, 2005 3:20 pm Post subject: |
|
|
C'est pas un paramètre générique lié au terminal de la machine sur laquelle tu te connectes, plutot?
Si t'as la possibilité de vérifier si ça fait pareil en local, ou bien si quelqu'un qui connait le paramètrage en question...
_________________
-TrueNAS & jails: µ-serv Gen8 E3-1260L, 16Go ECC + µ-serv N40L, 10Go ECC
-Réseau: APU2C4 (OpenWRT) + GS726Tv3 + 2x GS108Tv2 + Archer C5v1 (OpenWRT) |
|
| Back to top |
|
|
kedalel
n00b
Joined: 30 Aug 2004
Posts: 74
Location: Belgium
|
| Posted: Fri Dec 09, 2005 5:44 pm Post subject: |
|
|
J'avais ca a cause du firewall de mon routeur...
Donc j'ai mis ma gentoo en DMZ et utilisé iptables à la place  |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
French
