X-Recipient: archive-cygwin AT delorie DOT com
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org E460B389680C
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cygwin.com;
	s=default; t=1611342447;
	bh=Tm6enr5vCT9coZnzF7ERLqzzUeZ2k62BSaXxo2AoB6k=;
	h=To:Subject:Date:List-Id:List-Unsubscribe:List-Archive:List-Post:
	 List-Help:List-Subscribe:From:Reply-To:From;
	b=tgl+dQKuXYgVx/JhZdUconHOAe1gqf3Y52zzkvkoRs5e+b4xUkdKOmbPBXnnKj1gz
	 GEuqoPKjHSzH3sEUfHbfkXSlaIn1/kfjalTL1REoo7KyLNvxTtUoktpyWczmNhz0pa
	 T/pMup9r416o3qoGj3zuawJWb91uFe0QrXDG1bPs=
X-Original-To: cygwin AT cygwin DOT com
Delivered-To: cygwin AT cygwin DOT com
DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 9A8773894C3B
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20161025;
 h=x-gm-message-state:to:from:subject:message-id:date:user-agent
 :mime-version:content-language:content-transfer-encoding;
 bh=jM4mCqnotH3RD1jiSQDmAiPqoxCEpvSJhsGvaEXIB0Y=;
 b=YRhdZLdKi85QmFbp37V5UBrl+wj6e/fmIFZYsWxBB3f8iK7DjFKaIIprTREPyZiWmX
 5aFQnpBQ8op9LOj9UEotyxU8Qzez1hq0A/f3A75ZDqqd+C8Wb3OxGct2BlHkPPQjAIVp
 cCUqK7J7/jMArl+z2ZrOFGEmLj2/9C5chCGpxLQ/bllbmsRUn+tAkkw7CFJmqw9XADXV
 YjIt+v3kEzAX2i7hQDvsxsaD6kAaGDmvNEiQFXwbgj5GNX7fknIA6EdPknRgjxGHTNHa
 nRxTk6db+rG4FDWM+k4vP1MG033lxSziq5bx1iCPZlgtKvnCB6yhyTXymXf0e7lNj7Gk
 07zQ==
X-Gm-Message-State: AOAM530lh+JPG0013ZJPGvmmsecETAErQG3k84S1iW+NeKD3ABm7wWEv
 YYpk03Dee/StZ1uJU4wy/rLUFBUREe4=
X-Google-Smtp-Source: ABdhPJwcRm+PL9fw7TAPlLWOY8/PSYAem48fN1iyYF/EYbDJ35JUgI0ouh4tMtslMS4UTTDWRVGe+w==
X-Received: by 2002:ac2:593a:: with SMTP id v26mr2725367lfi.591.1611342442829; 
 Fri, 22 Jan 2021 11:07:22 -0800 (PST)
To: cygwin AT cygwin DOT com
Subject: sshd.exe waits repeatedly with SYN_SENT for inaccessible ldap
Message-ID: <67ec7d7f-cac0-3a2a-4f85-1d42f0864b46@gmail.com>
Date: Fri, 22 Jan 2021 22:07:18 +0300
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:78.0) Gecko/20100101
 Thunderbird/78.6.1
MIME-Version: 1.0
Content-Language: en-US
X-Spam-Status: No, score=-1.7 required=5.0 tests=BAYES_00, DKIM_SIGNED,
 DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,
 SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on
 server2.sourceware.org
X-BeenThere: cygwin AT cygwin DOT com
X-Mailman-Version: 2.1.29
List-Id: General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Archive: <https://cygwin.com/pipermail/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe: <https://cygwin.com/mailman/listinfo/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
From: Ilya Basin via Cygwin <cygwin AT cygwin DOT com>
Reply-To: basinilya AT gmail DOT com
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: "Cygwin" <cygwin-bounces AT cygwin DOT com>

Hi. The problem first appeared ten days ago. It now takes minutes to login as a domain user. Tcpview shows that sshd.exe is trying to connect an inaccessible server on the port 389 (ldap). If I close the socket using Tcpview, successful login happens sooner. Both password and public key logins are affected, but with a public key sshd.exe tries to connect that server multiple times. Also, if I don't close the sockets repeatedly, ssh disconnects from the SSH server after 2 minutes of silence before the "last login" line appears:

    $ time ssh -vvv localhost
    ...
    debug1: Offering public key:
    debug3: send packet: type 50
    debug2: we sent a publickey packet, wait for reply
    
    
    debug3: receive packet: type 60
    debug1: Server accepts key: 
    debug3: sign_and_send_pubkey: RSA
    debug3: sign_and_send_pubkey: signing using rsa-sha2-512
    debug3: send packet: type 50
    
    
    Connection closed by ::1 port 22
    
    real    2m0.292s
    user    0m0.045s
    sys     0m0.122s



Besedes, sshd.exe has a live connection on port 389 to another server all the time.


I can't see anything interesting in sshd log. At least the ldap ip address does not appear in the log.

    ...
    <TimeCreated SystemTime="2021-01-22T18:52:09.7210295Z" /> 
    <Data>sshd: PID 1786: debug1: temporarily_use_uid: 1087042/1049089 (e=18/18)</Data> 
      
    <TimeCreated SystemTime="2021-01-22T18:52:51.9304939Z" /> 
    <Data>sshd: PID 1786: debug1: trying public key file /home/basin/.ssh/authorized_keys</Data> 
    ...
    
    <TimeCreated SystemTime="2021-01-22T18:53:21.6284471Z" /> 
    <Data>sshd: PID 1786: debug1: temporarily_use_uid: 1087042/1049089 (e=18/18)</Data> 
    ...
    
    
    <TimeCreated SystemTime="2021-01-22T18:54:03.7296838Z" /> 
    <Data>sshd: PID 1786: debug1: trying public key file /home/basin/.ssh/authorized_keys</Data> 
    ...
    
    
    <TimeCreated SystemTime="2021-01-22T18:54:03.7296838Z" /> 
    <Data>sshd: PID 1786: debug1: monitor_child_preauth: basin has been authenticated by privileged process</Data> 
    ...
    
    
    <TimeCreated SystemTime="2021-01-22T18:54:09.6686942Z" /> 
    <Data>sshd: PID 1652: debug1: main_sigchld_handler: Child exited</Data> 

BTW, is it possible to make sshd write to a log file instead of Windows Event Log?


--
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple