openssh unix dev - Jul 2021 - strange failure

On Sun, Jul 25, 2021 at 10:32 PM Damien Miller <djm at mindrot.org>
wrote:
>
> On Sun, 25 Jul 2021, Saint Michael wrote:
>
> > There is a Centos 7 machine where this falls after 80 loops
> >
> > target="same host"
> > while [ $i -ne 500 ];do
> > echo -e "$i"
> > ssh -p 22 root@${target} "ls / 1>/dev/null &&
exit;"
> > ((i++))
> > done
> > The loop does not fail against Ubuntu boxes.
> > kindly let me know if I am doing something wrong.
>
> It's very hard to figure out what is wrong without logs (both client
> and server), but I'd start by checking your PAM configuration.
Stop playing with redirects and funkified exit values on the far end
if you don't have to. Just use ""/bin/true". And print $i
locally,
with a success or failure, to see *exactly* how many successful
connections you get.

Some smart alecks put in various rate limiting on intervening
firewalls or proxies, to limit port scanning and host scanning. You
might check there as well.

I am connecting to 127.0.01 and the problem persists. I am not using PAM.
But thanks for the /bin/true tip.



On Mon, Jul 26, 2021 at 12:44 AM Nico Kadel-Garcia <nkadel at gmail.com>
wrote:
> On Sun, Jul 25, 2021 at 10:32 PM Damien Miller <djm at mindrot.org>
wrote:
> >
> > On Sun, 25 Jul 2021, Saint Michael wrote:
> >
> > > There is a Centos 7 machine where this falls after 80 loops
> > >
> > > target="same host"
> > > while [ $i -ne 500 ];do
> > > echo -e "$i"
> > > ssh -p 22 root@${target} "ls / 1>/dev/null &&
exit;"
> > > ((i++))
> > > done
> > > The loop does not fail against Ubuntu boxes.
> > > kindly let me know if I am doing something wrong.
> >
> > It's very hard to figure out what is wrong without logs (both
client
> > and server), but I'd start by checking your PAM configuration.
>
> Stop playing with redirects and funkified exit values on the far end
> if you don't have to. Just use ""/bin/true". And print
$i locally,
> with a success or failure, to see *exactly* how many successful
> connections you get.
>
> Some smart alecks put in various rate limiting on intervening
> firewalls or proxies, to limit port scanning and host scanning. You
> might check there as well.
>