0

The problem is that when I ssh to my host with putty and enter user name, after that the password prompt delays. Found this is directly related to my iptables and can solve by changing default policy to ACCEPT. If default INPUT policy is ACCEPT, then password prompt is coming immediately.

Mar 13 00:05:01 server-ubuntu sshd[6154]: Connection from 192.168.0.10 port 26304 Mar 13 00:05:06 server-ubuntu sshd[6154]: Failed none for acid from 192.168.0.10 port 26304 ssh2

However, if default INPUT policy is DROP, I got slight delay in getting password prompt after I enter username

Mar 13 00:07:12 server-ubuntu sshd[6177]: Connection from 192.168.0.10 port 26333 Mar 13 00:07:35 server-ubuntu sshd[6177]: Failed none for acid from 192.168.0.10 port 26333 ssh2

For the second case, I tried to set default policy for FORWARD and OUTPUT chains to ACCEPT, but it didn't help. The only rule in this case is:

-A INPUT -i eth1 -m mac --mac-source 00:26:XX:XX:XX:XX -j ACCEPT

00:26:XX:XX:XX:XX is the mac address from which I am trying to ssh to server's LAN(eth1).

I'm sure there has to be some rule, which I can use while default INPUT chain policy is DENY in order to get password prompt immediately. I realize that the error message in the log is something normal and part of some verification procedure.

Improve this question
6
  • Looks like if I set UseDNS no in sshd config then the problem is solved. But this means that the server itself is failing to send/receive DNS queries. How to enable it from iptables? Commented Mar 13, 2011 at 5:44
  • I, too, suspect DNS. Can you post the output of iptables -L -n -v --line-numbers and cat /etc/resolv.conf so we can suggest a rule to permit DNS? Commented Mar 13, 2011 at 5:54
  • 1
    Well, actually just added -A INPUT -i eth0 -p UDP --sport 53 -j ACCEPT and solved the issue! Thx Commented Mar 13, 2011 at 6:00
  • Well done, you! Seriously, although breaking DNS can break lots of stuff, it can take a long time to work out what's going on. I think you should give yourself a pat on the back for some quality debugging, post that answer, and accept it - since it's right! Commented Mar 13, 2011 at 6:12
  • 2
    Adding -A INPUT -i eth1 -m state --state ESTABLISHED -j ACCEPT will allow return packages for outbound connections. Commented Mar 13, 2011 at 6:15

1 Answer 1

Reset to default
1

From the comments above.

The pause was caused by iptables blocking DNS queries. It was solved by opening port 53 

-A INPUT -i eth1 -p UDP --sport 53 -j ACCEPT
Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.