Issues with SSH 1

[Eddiefdz]

Hello,

I have a machine which is acting kind of weird. Until about 2 days ago, i could SSH into the machine with no problems at all. Now I can only connect to SSH every so often. Although I can ping the machine and its on the network, i have to keep retrying the connection until finally it connects. Any reason why it would be doing that? Is there any command that I can try to see if there is a problem with SSH?

Thanks for the help,
Eddie

Eddie Fernandez
CCNA, Network+, A+, MCP

 

[thedaver]

POssibilties:

- High system utilization affecting perceived performance of SSH login
- High hacking volume against your SSH in form of a dictionary attack which keeps your SSH sessions opening and closing, making it hard to get a new session
- High network traffic between you and the box preventing the establishment of a stable SSH "tunnel" to bring up the prompt/login
- Your SSH server is only willing to accept specific SSH protocols/encryption sizes, which are not being tried first by your client software (i.e. SSH1 vs. SSH2, 3DES vs. blowfish vs. AES)
- Bad kharma


D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/

 

[Eddiefdz]

Well, i really doubt system utilization is the problem, i ran TOP and the processor is completely idle. As per hacking, ssh ports are closed on my firewall from outside users. SSH only runs in the internal network. There may be network traffic, but also very unlikely, i have a 1gig connection from the switch to the server. And why would the server all of a sudden only willing to accept certain connections?

Eddie Fernandez
CCNA, Network+, A+, MCP

 

[thedaver]

Another possibility is that the SSH server is trying to do a reverse DNS lookup which may timeout and then allow you to connect anyways.

I cannot speak to the "suddenly factor", you need to think critically about everything that has changed not only on that server but what resources it uses for network, DNS, etc.

You may also need to make sure that you don't have a RAID disk gone bad.

D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/

 

[stefanhei]

Eddie, have you checked for duplicate IPs in your network, which could confuse your switch?
You may wish to review your logfiles (RH: /var/log/secure.* unless specified other in /etc/syslog.conf)

Stefan

 

[plamb]

any changes ie ML upgrades etc.check your error logs and /var/adm/messages file for any clues.

 

[Eddiefdz]

Stefanhei,

Thanks for the enlightment. I did in fact have the ip address in use already on the network. A switch that i recently put in place had the same ip address configured on it.

Thanks,
Eddie

Eddie Fernandez
CCNA, Network+, A+, MCP