ssh 连接慢问题

时间：2022-08-20 20:42:20

连接先看报错：

There were 11 failed login attempts since the last successful login.

先前有上百上千失败login，被攻击了，把短时间尝试登录失败的ip加入黑名单

写个脚本：

#! /bin/bash

cat /var/log/secure|awk '/Failed/{print $(NF-3)}'|sort|uniq -c|awk '{print $2"="$1;}' > /root/black.txt

DEFINE="10"

for i in `cat  /root/black.txt`

do

    IP=`echo | awk '{split("'${i}'", array, "=");print array[1]}'`

    NUM=`echo | awk '{split("'${i}'", array, "=");print array[2]}'`

    if [ $NUM -gt $DEFINE ];then

     grep $IP /etc/hosts.deny > /dev/null

      if [ $? -gt 0 ];then

          echo "sshd:$IP:deny" >> /etc/hosts.deny

      fi

    fi

done　

然后定时执行

crontab -e
*/ * * * *  sh /root/secure_ssh.sh

一分钟执行一次

攻击解决了，但是还是慢

其中xintd安装失败，yum镜像连不上所以换了

    -- :: cp /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup

    -- :: cd /etc/yum.repos.d/

    -- :: wget http://mirrors.163.com/.help/CentOS6-Base-163.repo

    -- :: yum makecache

    -- :: yum -y update

    -- :: vi

    -- :: yum install xinetd.x86_64

    -- :: service xinetd start

    -- :: /bin/systemctl start xinetd.service

各种修改/etc/resolv.conf

#nameserver 183.60.83.19

nameserver 8.8.8.8

nameserver 114.114.114.114

#nameserver 183.60.82.98

#search localdomain

#options timeout: rotate

重启网络

/etc/init.d/network restart

不起作用

把网上流行做法，都做了

systemcts status systemd-logind

因为确实有login超时

也顺便

systemctl restart dbus

了一下，没用

费力气安装stract，用它来查看栈信息

strace -o ~/starce_ssh.txt -T ssh localhost
tail -f ~/starce_ssh.txt

但是看不懂。。。。。。

下面的肯定先做了

vim /etc/ssh/sshd_config

做

UseDNS no
#service sshd restart

修改GSSAPIAuthentication参数为 no，默认是yes

#service sshd restart

显然是没用，采用上上面的方法

也调试日志了

ssh  -vvv root@*.*.*.*

输入密码后，在这里等待

debug1: Next authentication method: password

root@*********'s password:

debug3: packet_send2: adding  (len  padlen  extra_pad )

debug2: we sent a password packet, wait for reply

debug3: Wrote  bytes for a total of

debug1: Authentication succeeded (password).

debug1: channel : new [client-session]

debug3: ssh_session2_open: channel_new:

debug2: channel : send open

debug1: Requesting no-more-sessions@openssh.com

debug1: Entering interactive session.

debug3: Wrote  bytes for a total of

很久以后

debug1: Entering interactive session.

debug3: Wrote  bytes for a total of

debug1: client_input_global_request: rtype hostkeys-@openssh.com want_reply

debug2: callback start

debug2: client_session2_setup: id

debug2: channel : request pty-req confirm

debug2: channel : request shell confirm

debug2: fd  setting TCP_NODELAY

debug2: callback done

debug2: channel : open confirm rwindow  rmax

debug3: Wrote  bytes for a total of

debug2: channel_input_status_confirm: type  id

debug2: PTY allocation request accepted on channel

debug2: channel : rcvd adjust

debug2: channel_input_status_confirm: type  id

debug2: shell request accepted on channel

Last failed login: Thu Jun  :: CST  from 112.85.42.201 on ssh:notty

There were  failed login attempts since the last successful login.

Last login: Thu Jun  ::  from 124.204.55.194

[root@VM_128_5_centos ~]#

分析了很久很多停顿时候以及前后的打印信息，对比

这些客户端信息正常

查看服务器日志：

tail -f /var/log/messages

登录时认证很快，并创建session

Jun  :: localhost systemd: Started Session  of user root.

Jun  :: localhost systemd-logind: New session  of user root.

Jun  :: localhost systemd: Starting Session  of user root.

ssh 连接慢问题

详细日志

Jun  :: localhost sshd[]: Accepted password for root from 124.204.55.194 port  ssh2

Jun  :: localhost systemd: Started Session  of user root.

Jun  :: localhost systemd-logind: New session  of user root.

Jun  :: localhost systemd: Starting Session  of user root.

Jun  :: localhost systemd: Started Session  of user root.

Jun  :: localhost systemd: Starting Session  of user root.

Jun  :: localhost systemd: Started Session  of user root.

Jun  :: localhost systemd: Starting Session  of user root.

Jun  :: localhost systemd: Started Session  of user root.

Jun  :: localhost systemd: Starting Session  of user root.

Jun  :: localhost sshd[]: Failed password for root from 123.59.209.10 port  ssh2

Jun  :: localhost systemd: Started Session  of user root.

Jun  :: localhost systemd: Starting Session  of user root.

Jun  :: localhost sshd[]: Received disconnect from 123.59.209.10 port :: Normal Shutdown, Thank you for playing [preauth]

Jun  :: localhost sshd[]: Disconnected from 123.59.209.10 port  [preauth]

Jun  :: localhost systemd: Started Session  of user root.

Jun  :: localhost systemd: Starting Session  of user root.

前面并没有这么多凭空的session产生，现在为什么这么多？

线索：https://www.depesz.com/2010/12/13/a-tale-of-slow-ssh-connections/

https://major.io/2015/07/27/very-slow-ssh-logins-on-fedora-22/

https://serverfault.com/questions/707377/slow-ssh-login-activation-of-org-freedesktop-login1-timed-out#

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=793814

相关文章