Our connectivity outside of the valley was disrupted this morning. I sit in one domain, and our club repeater sits in another (first digits of IP address different). I could ping the repeater IP address, with a reasonable response, but when I attempted to login, it requested my login name, but would not return to request the password. I had the same difficulty with two Allstar servers in my local domain, with me behind my firewall. The question is this, what might the ACID build be expecting from the WWW that was not available to it during this larger system outage, that would not allow it to respond to my login with a return request for the password? Thanks, Bob kk6ecm
Someone may have a better answer than I but, I think the problem is that the DNS servers changed. You probably need a way to reset the connections via radio where a automatic update of the DNS could be obtained. Internet outages and resets are a growing problem in the US. Going to get worse before(/if) it gets better. Some of it is just internal resets and some of it from hacks. ...mike/kb8jnm
Our connectivity outside of the valley was disrupted this morning. I sit in one domain, and our club repeater sits in another (first digits of IP address different). I could ping the repeater IP address, with a reasonable response, but when I attempted to login, it requested my login name, but would not return to request the password. I had the same difficulty with two Allstar servers in my local domain, with me behind my firewall.
The question is this, what might the ACID build be expecting from the WWW that was not available to it during this larger system outage, that would not allow it to respond to my login with a return request for the password?
Thanks, Bob kk6ecm
_______________________________________________ App_rpt-users mailing list App_rpt-users@ohnosec.org http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
kk6ecm wrote:
Our connectivity outside of the valley was disrupted this morning. I sit in one domain, and our club repeater sits in another (first digits of IP address different). I could ping the repeater IP address, with a reasonable response, but when I attempted to login, it requested my login name, but would not return to request the password. I had the same difficulty with two Allstar servers in my local domain, with me behind my firewall.
The question is this, what might the ACID build be expecting from the WWW that was not available to it during this larger system outage, that would not allow it to respond to my login with a return request for the password?
Bob, This most likely is broken DNS. SSH will log the attempt after you enter the user name along with IP address and reverse DNS (PTR Record) before it will even prompt for the password. It likely is stuck waiting on a DNS response that is not forthcoming. Sometimes the request will time out before the login will - other times not. Likely your network outage broke your DNS chain. Either you can't reach your recursive DNS server - or - if your using your own local resolver, then it's unable to reach certain points it needs to resolve the reverse PTR record and is stuck awaiting for a response. You can put "UseDNS no" in your sshd config file to stop it from doing this. That is, once you can get back into that box! 73's Joel/N7GLV
Thanks all, As Mike says, the DNS server changed... In fact, it went away for the repeater site, but not for the local site, where my DNS is my router. It looks like I should use "UseDNS no" in sshd_conf, as suggested by Joel. I'm not sure why a DNS would be required for SSH. Thanks, Bob kk6ecm -----Original Message----- From: app_rpt-users-bounces@ohnosec.org [mailto:app_rpt-users-bounces@ohnosec.org] On Behalf Of Joel Sent: Thursday, April 02, 2015 8:28 AM To: app_rpt-users@ohnosec.org Subject: Re: [App_rpt-users] Server Login Anomaly kk6ecm wrote:
Our connectivity outside of the valley was disrupted this morning. I sit
in
one domain, and our club repeater sits in another (first digits of IP address different). I could ping the repeater IP address, with a reasonable response, but when I attempted to login, it requested my login name, but would not return to request the password. I had the same difficulty with two Allstar servers in my local domain, with me behind my firewall.
The question is this, what might the ACID build be expecting from the WWW that was not available to it during this larger system outage, that would not allow it to respond to my login with a return request for the password?
Bob, This most likely is broken DNS. SSH will log the attempt after you enter the user name along with IP address and reverse DNS (PTR Record) before it will even prompt for the password. It likely is stuck waiting on a DNS response that is not forthcoming. Sometimes the request will time out before the login will - other times not. Likely your network outage broke your DNS chain. Either you can't reach your recursive DNS server - or - if your using your own local resolver, then it's unable to reach certain points it needs to resolve the reverse PTR record and is stuck awaiting for a response. You can put "UseDNS no" in your sshd config file to stop it from doing this. That is, once you can get back into that box! 73's Joel/N7GLV _______________________________________________ App_rpt-users mailing list App_rpt-users@ohnosec.org http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
kk6ecm wrote:
Thanks all,
As Mike says, the DNS server changed... In fact, it went away for the repeater site, but not for the local site, where my DNS is my router. It looks like I should use "UseDNS no" in sshd_conf, as suggested by Joel. I'm not sure why a DNS would be required for SSH.
Bob, It's done as a security check. Ideally your forward and reverse DNS records always match. In my network I handle ALL my DNS in both directions - so everything always matches unless I forget to update one of my zones. So knowing there is a discrepancy is a nice. If someone was to hijack your forward records (happens a lot anymore with big ISP's), chances are they will direct you to a new network/IP for which the reverse will no longer match and it will alert you and let you know that you might be under a re-direct attack and do you want to continue. With this turned off - you will lack that check. Also, sshd is trying to commit to the syslog the connection attempt before it even proceeds with authentication. This is another GOOD Unix thing.. If your using off-site syslog - the attempt is logged away before they can even try to get into the machine where they could erase logs to cover their tracks. I always advise people to use key exchange for auth on SSH connections if possible. Then turn off password auth in the ssh server. Adds a nice extra layer of security. 73's Joel/N7GLV
participants (3)
-
Joel -
kk6ecm -
mike＠midnighteng.com