openssh bugs - Feb 2016 - [Bug 2545] New: reverse DNS lookups shouldn't block login

https://bugzilla.mindrot.org/show_bug.cgi?id=2545

            Bug ID: 2545
           Summary: reverse DNS lookups shouldn't block login
           Product: Portable OpenSSH
           Version: 6.6p1
          Hardware: All
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: P5
         Component: sshd
          Assignee: unassigned-bugs at mindrot.org
          Reporter: bugzilla.mindrot.org at beej.org

sshd currently blocks on doing a reverse DNS lookup during login when
UseDNS is yes.  this normally doesn't present a problem, but broken or
misconfigured resolvers and servers can cause a 20-second penalty to
sshd users.

sshd should do the name resolution in a non-blocking way.

see https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/424371

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2545

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |WONTFIX
                 CC|                            |djm at mindrot.org

--- Comment #1 from Damien Miller <djm at mindrot.org> ---
We don't intend to fix this.

With UseDNS=yes, we need the remote hostname fairly early in the
connection life for sshd_config Match and authorized_keys restrictions,
so doing the lookup asynchrounously wouldn't really help - we'd need to
block at those points anyway until we get an answer.

UseDNS=no is the default for this reason (among others).

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2545

Darren Tucker <dtucker at zip.com.au> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dtucker at zip.com.au

--- Comment #2 from Darren Tucker <dtucker at zip.com.au> ---
There's also a couple of system-level dependencies performing the
login:
 - PAM_RHOST, if PAM is enabled.
 - writing remote hostname to utmp/wtmp records

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2545

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #3 from Damien Miller <djm at mindrot.org> ---
Close all resolved bugs after 7.3p1 release

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.