Re: Slow ssh logins when running nslcd

[Daniel Macdonald <D.R.MacDonald [at] salford.ac.uk>]

After further testing and rebooting the server to fix errors like these:

systemctl status ssh

● ssh.service - OpenBSD Secure Shell server

     Loaded: loaded (/lib/systemd/system/ssh.service; enabled; vendor preset: enabled)

     Active: active (running) since Fri 2022-01-28 12:33:27 GMT; 5s ago

       Docs: man:sshd(8)

             man:sshd_config(5)

    Process: 1839766 ExecStartPre=/usr/sbin/sshd -t (code=exited, status=0/SUCCESS)

   Main PID: 1839767 (sshd)

      Tasks: 8 (limit: 154001)

     Memory: 200.4M

     CGroup: /system.slice/ssh.service

             ├─1835093 sshd: ltspadmin [priv]

             ├─1835350 sshd: ltspadmin@pts/0

             ├─1835352 -bash

             ├─1835563 sudo -s

             ├─1835582 /bin/bash

             ├─1839767 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups

             ├─1839795 systemctl status ssh

             └─1839796 pager

Jan 28 12:33:27 asteria.cs.salford.ac.uk systemd[1]: This usually indicates unclean termination of a previous run, or service implementation defi>

Jan 28 12:33:27 asteria.cs.salford.ac.uk systemd[1]: ssh.service: Found left-over process 1835582 (bash) in control group while starting unit. Ig>

Jan 28 12:33:27 asteria.cs.salford.ac.uk systemd[1]: This usually indicates unclean termination of a previous run, or service implementation defi>

Jan 28 12:33:27 asteria.cs.salford.ac.uk systemd[1]: ssh.service: Found left-over process 1839764 (systemctl) in control group while starting uni>

Jan 28 12:33:27 asteria.cs.salford.ac.uk systemd[1]: This usually indicates unclean termination of a previous run, or service implementation defi>

Jan 28 12:33:27 asteria.cs.salford.ac.uk systemd[1]: ssh.service: Found left-over process 1839765 (systemd-tty-ask) in control group while starti>

Jan 28 12:33:27 asteria.cs.salford.ac.uk systemd[1]: This usually indicates unclean termination of a previous run, or service implementation defi>

Jan 28 12:33:27 asteria.cs.salford.ac.uk sshd[1839767]: Server listening on 0.0.0.0 port 22.

Jan 28 12:33:27 asteria.cs.salford.ac.uk sshd[1839767]: Server listening on :: port 22.

Jan 28 12:33:27 asteria.cs.salford.ac.uk systemd[1]: Started OpenBSD Secure Shell server.

There is actually only a delay of about 14s when logging in using a SSH key. I have tried specifying my identity file using the ssh option and disabling unused key types on the server but it hasn't made logins any faster when using a ssh key.

If I stop nslcd, logging in with a ssh key takes less than 2 seconds vs 14 with nslcd running.

 

DANIEL MACDONALD Specialist Technical Demonstrator School of Computing, Science & Engineering Room 145, Newton Building, University of Salford, Manchester M5 4WT T: +44(0) 0161 295 5242 D.R.MacDonald@salford.ac.uk  /  www.salford.ac.uk

---

From: Daniel Macdonald <D.R.MacDonald@salford.ac.uk>
Sent: 28 January 2022 12:24
To: nss-pam-ldapd-users@lists.arthurdejong.org <nss-pam-ldapd-users@lists.arthurdejong.org>
Subject: Re: Slow ssh logins when running nslcd

 

I should've also included this:

#

# /etc/pam.d/common-auth - authentication settings common to all services

#

# This file is included from other service-specific PAM config files,

# and should contain a list of the authentication modules that define

# the central authentication scheme for use on the system

# (e.g., /etc/shadow, LDAP, Kerberos, etc.).  The default is to use the

# traditional Unix authentication mechanisms.

#

# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.

# To take advantage of this, it is recommended that you configure any

# local modules either before or after the default block, and use

# pam-auth-update to manage selection of other modules.  See

# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)

auth    [success=2 default=ignore]      pam_unix.so nullok

auth    [success=1 default=ignore]      pam_ldap.so minimum_uid=1000 use_first_pass

# here's the fallback if no module succeeds

auth    requisite                       pam_deny.so

# prime the stack with a positive return value if there isn't one already;

# this avoids us returning an error just because nothing sets a success code

# since the modules above will each just jump around

auth    required                        pam_permit.so

# and here are more per-package modules (the "Additional" block)

auth    optional                        pam_cap.so

# end of pam-auth-update config

 

DANIEL MACDONALD Specialist Technical Demonstrator School of Computing, Science & Engineering Room 145, Newton Building, University of Salford, Manchester M5 4WT T: +44(0) 0161 295 5242 D.R.MacDonald@salford.ac.uk  /  www.salford.ac.uk

---

From: Daniel Macdonald
Sent: 27 January 2022 17:21
To: nss-pam-ldapd-users@lists.arthurdejong.org <nss-pam-ldapd-users@lists.arthurdejong.org>
Subject: Slow ssh logins when running nslcd

 

I'm setting up a Ubuntu 20.04 server that needs to run nslcd to authenticate with LDAP on a Windows 2016 server. If I stop the nslcd service, ssh logins to this server are instant (with keys) and the password prompt appears immediately if the user doesn't have a key configured however when nslcd is running ssh logins take about 20 seconds or longer. Authenticating against LDAP isn't slow either unless sshd is running.

I've followed a few guides to reduce ssh login times but it hasn't made much difference. The only thing that fixes it is stopping nslcd so I presume its a either a nslcd or pam config problem. I tried disabling ssh key auth but that didn't make any notable difference and that it a feature I would like to keep enabled.

-------------------------------------------------------------------------------------

# /etc/nslcd.conf

# nslcd configuration file. See nslcd.conf(5)

# for details.

# The user and group nslcd should run as.

uid nslcd

gid nslcd

# The location at which the LDAP server(s) should be reachable.

uri ldap://uos-p-rodc-11.isdads.salford.ac.uk:389

# The search base that will be used for all queries.

base dc=isdads,dc=salford,dc=ac,dc=uk

# The LDAP protocol version to use.

#ldap_version 3

# The DN to bind with for normal lookups.

binddn LDAP-P-CSE1@ISDADS.SALFORD.AC.UK

bindpw LDAPPASSWORDHERE

# The DN used for password modifications by root.

#rootpwmoddn cn=admin,dc=example,dc=com

# SSL options

ssl off

tls_reqcert never

#tls_cacertfile /etc/ssl/certs/ca-certificates.crt

# The search scope.

scope sub

timelimit 10

pagesize 1000

referrals off

idle_timelimit 800

filter passwd (&(objectClass=user)(!(objectClass=computer))(uidNumber=*)(unixHomeDirectory=*))

filter group (objectClass=group)

map    passwd uid              sAMAccountName

map    passwd homeDirectory    unixHomeDirectory

map    passwd gecos            displayName

map    passwd loginShell    "/bin/bash"

filter shadow (&(objectClass=user)(!(objectClass=computer))(uidNumber=*)(unixHomeDirectory=*))

map    shadow uid              sAMAccountName

map    shadow shadowLastChange pwdLastSet

-------------------------------------------------------------------------------------

# /etc/nsswitch.conf

#

# Example configuration of GNU Name Service Switch functionality.

# If you have the `glibc-doc-reference' and `info' packages installed, try:

# `info libc "Name Service Switch"' for information about this file.

passwd:         files ldap

group:          files ldap

shadow:         files ldap

gshadow:        files

hosts:          files mdns4_minimal [NOTFOUND=return] dns

networks:       files

protocols:      db files

services:       db files

ethers:         db files

rpc:            db files

netgroup:       nis

-------------------------------------------------------------------------------------

# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $

# This is the sshd server system-wide configuration file.  See

# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with

# OpenSSH is to specify options with their default value where

# possible, but leave them commented.  Uncommented options override the

# default value.

Include /etc/ssh/sshd_config.d/*.conf

#Port 22

#AddressFamily any

#ListenAddress 0.0.0.0

#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key

#HostKey /etc/ssh/ssh_host_ecdsa_key

#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying

#RekeyLimit default none

# Logging

#SyslogFacility AUTH

#LogLevel INFO

# Authentication:

#LoginGraceTime 2m

PermitRootLogin no

#StrictModes yes

#MaxAuthTries 6

#MaxSessions 10

PubkeyAuthentication yes

# Expect .ssh/authorized_keys2 to be disregarded by default in future.

#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none

#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts

HostbasedAuthentication no

# Change to yes if you don't trust ~/.ssh/known_hosts for

# HostbasedAuthentication

#IgnoreUserKnownHosts no

# Don't read the user's ~/.rhosts and ~/.shosts files

IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!

PasswordAuthentication yes

#PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with

# some PAM modules and threads)

ChallengeResponseAuthentication no

# Kerberos options

#KerberosAuthentication no

#KerberosOrLocalPasswd yes

#KerberosTicketCleanup yes

#KerberosGetAFSToken no

# GSSAPI options

GSSAPIAuthentication no

#GSSAPICleanupCredentials yes

#GSSAPIStrictAcceptorCheck yes

#GSSAPIKeyExchange no

# Set this to 'yes' to enable PAM authentication, account processing,

# and session processing. If this is enabled, PAM authentication will

# be allowed through the ChallengeResponseAuthentication and

# PasswordAuthentication.  Depending on your PAM configuration,

# PAM authentication via ChallengeResponseAuthentication may bypass

# the setting of "PermitRootLogin without-password".

# If you just want the PAM account and session checks to run without

# PAM authentication, then enable this but set PasswordAuthentication

# and ChallengeResponseAuthentication to 'no'.

UsePAM yes

#AllowAgentForwarding yes

#AllowTcpForwarding yes

#GatewayPorts no

X11Forwarding yes

#X11DisplayOffset 10

#X11UseLocalhost yes

#PermitTTY yes

PrintMotd no

#PrintLastLog yes

#TCPKeepAlive yes

#PermitUserEnvironment no

#Compression delayed

#ClientAliveInterval 0

#ClientAliveCountMax 3

UseDNS no

#PidFile /var/run/sshd.pid

#MaxStartups 10:30:100

#PermitTunnel no

#ChrootDirectory none

#VersionAddendum none

# no default banner path

#Banner none

# Allow client to pass locale environment variables

AcceptEnv LANG LC_*

# override default of no subsystems

Subsystem sftp /usr/lib/openssh/sftp-server

# Example of overriding settings on a per-user basis

#Match User anoncvs

# X11Forwarding no

# AllowTcpForwarding no

# PermitTTY no

# ForceCommand cvs server

-------------------------------------------------------------------------------------

#

# /etc/pam.d/common-session - session-related modules common to all services

#

# This file is included from other service-specific PAM config files,

# and should contain a list of modules that define tasks to be performed

# at the start and end of sessions of *any* kind (both interactive and

# non-interactive).

#

# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.

# To take advantage of this, it is recommended that you configure any

# local modules either before or after the default block, and use

# pam-auth-update to manage selection of other modules.  See

# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)

session [default=1] pam_permit.so

# here's the fallback if no module succeeds

session requisite pam_deny.so

# prime the stack with a positive return value if there isn't one already;

# this avoids us returning an error just because nothing sets a success code

# since the modules above will each just jump around

session required pam_permit.so

# The pam_umask module will set the umask according to the system default in

# /etc/login.defs and user settings, solving the problem of different

# umask settings with different shells, display managers, remote sessions etc.

# See "man pam_umask".

session optional pam_umask.so

# and here are more per-package modules (the "Additional" block)

session required pam_unix.so

session [success=ok default=ignore] pam_ldap.so minimum_uid=1000

session optional pam_systemd.so

# end of pam-auth-update config

Thanks

 

DANIEL MACDONALD Specialist Technical Demonstrator School of Computing, Science & Engineering Room 145, Newton Building, University of Salford, Manchester M5 4WT T: +44(0) 0161 295 5242 D.R.MacDonald@salford.ac.uk  /  www.salford.ac.uk