Delay in authentication.

Delay in authentication.

[Ansari]

Hi !!

I just installed Redhat 6.0. When i run  "su" command it takes much time
to apper passwd prompt.
Its also taking much time in authentication after entering the password.



Regards,
Nauman Ansari

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

Re: Delay in authentication.

[David S. Miller]

   Date: 	Mon, 08 Jan 2001 18:39:34 +0500
   From: Ansari <mike@khi.sdnpk.org>

   I just installed Redhat 6.0. When i run "su" command it takes much
   time to apper passwd prompt.  Its also taking much time in
   authentication after entering the password.

This definitely seems like the classic "/etc/nsswitch.conf is told to
look for YP servers and you are not using YP", so have a look and fix
nsswitch.conf if this is in fact the problem.

Later,
David S. Miller
davem@redhat.com
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

Re: Delay in authentication.

[Ansari]

"David S. Miller" wrote:

>    Date:        Mon, 08 Jan 2001 18:39:34 +0500
>    From: Ansari <mike@khi.sdnpk.org>
>
>    I just installed Redhat 6.0. When i run "su" command it takes much
>    time to apper passwd prompt.  Its also taking much time in
>    authentication after entering the password.
>
> This definitely seems like the classic "/etc/nsswitch.conf is told to
> look for YP servers and you are not using YP", so have a look and fix
> nsswitch.conf if this is in fact the problem.
>

No /etc/nsswitch.conf is not looking for YP server. I hav following entry
in my /etc/nsswitch.conf

#       nis or yp               Use NIS (NIS version 2), also called YP






-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

Re: Delay in authentication.

[Chris Meadors]

On Mon, 8 Jan 2001, David S. Miller wrote:

> This definitely seems like the classic "/etc/nsswitch.conf is told to
> look for YP servers and you are not using YP", so have a look and fix
> nsswitch.conf if this is in fact the problem.

What I have never gotten, is why on my machines (no specific distro, just
everything built from source and installed by me) login takes a long time,
unless I have portmap running.

My /etc/nsswitch.conf would seem to be right:

passwd:         files
group:          files
shadow:         files

hosts:          files dns
networks:       files dns

protocols:      files
services:       files
ethers:         files
rpc:            files

netgroup:       files

What else could effect that?

-Chris
-- 
Two penguins were walking on an iceberg.  The first penguin said to the
second, "you look like you are wearing a tuxedo."  The second penguin
said, "I might be..."                         --David Lynch, Twin Peaks

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

Re: Delay in authentication.

[Igmar Palsenberg]

On Mon, 8 Jan 2001, Chris Meadors wrote:

> On Mon, 8 Jan 2001, David S. Miller wrote:
> 
> > This definitely seems like the classic "/etc/nsswitch.conf is told to
> > look for YP servers and you are not using YP", so have a look and fix
> > nsswitch.conf if this is in fact the problem.
> 
> What I have never gotten, is why on my machines (no specific distro, just
> everything built from source and installed by me) login takes a long time,
> unless I have portmap running.
> 
> My /etc/nsswitch.conf would seem to be right:
> 
> What else could effect that?

check /etc/pam.d/login

Could be kerberos that is biting you, althrough that doesn't explain the
portmap story.



	Igmar


	

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

Re: Delay in authentication.

[Chris Meadors]

On Mon, 8 Jan 2001, Igmar Palsenberg wrote:

> check /etc/pam.d/login

No pam.

> Could be kerberos that is biting you, althrough that doesn't explain the
> portmap story.

So no kerberos.

I just rebuilt the shadow suite (where my login comes from) to be on the
safe side.  But the problem is still there.

ldd login shows:
        libshadow.so.0 => /lib/libshadow.so.0 (0x4001a000)
        libcrypt.so.1 => /lib/libcrypt.so.1 (0x40033000)
        libc.so.6 => /lib/libc.so.6 (0x40060000)
        /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)

I'm running glibc-2.2, but this problem also existed in 2.1.x (which I had
installed when I went to the 2.3 kernels that exposed this problem).

-Chris
-- 
Two penguins were walking on an iceberg.  The first penguin said to the
second, "you look like you are wearing a tuxedo."  The second penguin
said, "I might be..."                         --David Lynch, Twin Peaks

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

Re: Delay in authentication.

[Scott Laird]

Is syslog running correctly?  When syslog screws up, it very frequently
results in this sort of problem.


Scott

On Mon, 8 Jan 2001, Chris Meadors wrote:

> On Mon, 8 Jan 2001, Igmar Palsenberg wrote:
> 
> > check /etc/pam.d/login
> 
> No pam.
> 
> > Could be kerberos that is biting you, althrough that doesn't explain the
> > portmap story.
> 
> So no kerberos.
> 
> I just rebuilt the shadow suite (where my login comes from) to be on the
> safe side.  But the problem is still there.
> 
> ldd login shows:
>         libshadow.so.0 => /lib/libshadow.so.0 (0x4001a000)
>         libcrypt.so.1 => /lib/libcrypt.so.1 (0x40033000)
>         libc.so.6 => /lib/libc.so.6 (0x40060000)
>         /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)
> 
> I'm running glibc-2.2, but this problem also existed in 2.1.x (which I had
> installed when I went to the 2.3 kernels that exposed this problem).
> 
> -Chris
> -- 
> Two penguins were walking on an iceberg.  The first penguin said to the
> second, "you look like you are wearing a tuxedo."  The second penguin
> said, "I might be..."                         --David Lynch, Twin Peaks
> 
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> Please read the FAQ at http://www.tux.org/lkml/
> 
> 

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

Re: Delay in authentication.

[Chris Meadors]

On Mon, 8 Jan 2001, Scott Laird wrote:

>
> Is syslog running correctly?  When syslog screws up, it very frequently
> results in this sort of problem.
>

I would guess that syslog is okay.  I'm getting plenty of entries in my
various logs, along with a few boxes remote logging into this server.

Another interesting thing I have noticed about this delay.  If I remove
the data in the password field from the shadow file ("username::...")
there is no pause during login.

-Chris
-- 
Two penguins were walking on an iceberg.  The first penguin said to the
second, "you look like you are wearing a tuxedo."  The second penguin
said, "I might be..."                         --David Lynch, Twin Peaks

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

Re: Delay in authentication.

[Igmar Palsenberg]

On Mon, 8 Jan 2001, Scott Laird wrote:

> 
> Is syslog running correctly?  When syslog screws up, it very frequently
> results in this sort of problem.

Indeed, or no DNS when talking remote logins.


	Igmar

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

Re: Delay in authentication.

[David S. Miller]

   Date: Mon, 08 Jan 2001 15:24:55 -0600
   From: "M.H.VanLeeuwen" <mhvl@linuxia.ih.lucent.com>

   Was this behavior intentionally changed and why?

   Looks like 2.2.X gives ECONNREFUSED, but 2.4.X doesn't and times out.

It was intentionally changed because there is no way for the "ICMP
port unreachable" message coming back to be uniquely matched to that
UDP socket.  It can reset sockets illegally in high load scenerios.

Solaris and other systems act identically.

Later,
David S. Miller
davem@redhat.com
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

Re: Delay in authentication.gy

[Alan Cox]

> It was intentionally changed because there is no way for the "ICMP
> port unreachable" message coming back to be uniquely matched to that
> UDP socket.  It can reset sockets illegally in high load scenerios.
> 
> Solaris and other systems act identically.

And have identical bad problems with auth failures. Right now I've given up
trying to make 2.4 and YP mix because my RH setup assumes NIS auth will fail
fast during boot up scripts and it doesnt.

Unfortunately for the quickfix folks, Dave is right about needing to sort it,
and that means someone has to sort glibc to use the new interfaces

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

Re: Delay in authentication.gy

[David S. Miller]

   Date: 	Mon, 8 Jan 2001 22:01:26 +0000 (GMT)
   From: Alan Cox <alan@lxorguk.ukuu.org.uk>

   > Solaris and other systems act identically.

   And have identical bad problems with auth failures.

Actually, I believe their sunrpc library uses an extended error
facility via the streams APIs that works similar to what is available
under Linux to solve this problem.

Later,
David S. Miller
davem@redhat.com
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

Re: Delay in authentication.gy

[Andi Kleen]

On Mon, Jan 08, 2001 at 10:01:26PM +0000, Alan Cox wrote:
> > It was intentionally changed because there is no way for the "ICMP
> > port unreachable" message coming back to be uniquely matched to that
> > UDP socket.  It can reset sockets illegally in high load scenerios.
> > 
> > Solaris and other systems act identically.
> 
> And have identical bad problems with auth failures. Right now I've given up
> trying to make 2.4 and YP mix because my RH setup assumes NIS auth will fail
> fast during boot up scripts and it doesnt.
> 
> Unfortunately for the quickfix folks, Dave is right about needing to sort it,
> and that means someone has to sort glibc to use the new interfaces

If anyone wants to fix and doesn't know how -- 
http://www.firstfloor.org/~andi/OLS/img27.htm and following slides describe the
Linux interface. Note that msg_name as original destination is not set in some 2.2 
kernels, so that needs to be handled too. 



-Andi
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

Re: Delay in authentication.gy

[Chris Meadors]

On Mon, 8 Jan 2001, Alan Cox wrote:

> And have identical bad problems with auth failures. Right now I've given up
> trying to make 2.4 and YP mix because my RH setup assumes NIS auth will fail
> fast during boot up scripts and it doesnt.
>
> Unfortunately for the quickfix folks, Dave is right about needing to sort it,
> and that means someone has to sort glibc to use the new interfaces

I just compiled glibc 2.2.1 against the 2.4.0 kernel headers today.  I
went to the local console to login.  I was expecting to go get a coffee
after typing my password, but was pleasantly surprised to see the prompt
waiting for me in no time at all.

So the newest glibc seems to have the problem fixed for me now.

-Chris
-- 
Two penguins were walking on an iceberg.  The first penguin said to the
second, "you look like you are wearing a tuxedo."  The second penguin
said, "I might be..."                         --David Lynch, Twin Peaks

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

Re: Delay in authentication.

[M.H.VanLeeuwen]

Chris,

I reported the same thing on 11/19/00, whether this is a feature or bug for
2.4.X was not determined.  Was this behavior intentionally changed and why?

Looks like 2.2.X gives ECONNREFUSED, but 2.4.X doesn't and times out.

http://www.mail-archive.com/linux-kernel@vger.kernel.org/msg13983.html text below.

Martin

----------------------------------------


       I had occasion to "telinit 1" today and found that it took a long time
       to login after root passwd was entered.  this doesn't happen with 2.2.X
       kernels.

       Is this to be expected with the 2.4 series kernels? or a bug?

       Martin

       strace for 2.4.0-test11-pre7

       ---snip---
       gettimeofday({974665658, 952483}, NULL) = 0
       socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP) = 3
       getpid()                                = 305
       bind(3, {sin_family=AF_INET, sin_port=htons(905), sin_addr=inet_addr("0.0.0.0")}}, 16) 
       = 0
       ioctl(3, FIONBIO, [1])                  = 0
       sendto(3, "\31\23\233@\0\0\0\0\0\0\0\2\0\1\206\240\0\0\0\2\0\0\0\3"..., 56, 0, 
       {sin_family=AF_INET, sin_port=htons(111),
       sin_addr=inet_addr("127.0.0.1")}}, 16) = 56
       poll([{fd=3, events=POLLIN}], 1, 5000)  = 0
       ioctl(3, SIOCGIFCONF, 0xbfffb33c)       = 0
       ioctl(3, SIOCGIFFLAGS, 0xbfffb344)      = 0
       sendto(3, "\31\23\233@\0\0\0\0\0\0\0\2\0\1\206\240\0\0\0\2\0\0\0\3"..., 56, 0, 
       {sin_family=AF_INET, sin_port=htons(111),
       sin_addr=inet_addr("127.0.0.1")}}, 16) = 56 
       ---snip---

       strace for 2.2.17

       ---snip---
       gettimeofday({974664928, 735539}, NULL) = 0
       socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP) = 3
       getpid()                                = 368
       bind(3, {sin_family=AF_INET, sin_port=htons(968), sin_addr=inet_addr("0.0.0.0")}}, 16) 
       = 0
       ioctl(3, FIONBIO, [1])                  = 0
       sendto(3, "_c\353\331\0\0\0\0\0\0\0\2\0\1\206\240\0\0\0\2\0\0\0\3"..., 56, 0, 
       {sin_family=AF_INET, sin_port=htons(111),
       sin_addr=inet_addr("127.0.0.1")}}, 16) = 56
       poll([{fd=3, events=POLLIN, revents=POLLERR}], 1, 5000) = 1
       recvfrom(3, 0x8056380, 400, 0, 0xbfffd66c, 0xbfffd618) = -1 ECONNREFUSED (Connection 
       refused)
       close(3)                                = 0  
       ---snip---

---------------------------------------------------------------------

Chris Meadors wrote:
> 
> On Mon, 8 Jan 2001, David S. Miller wrote:
> 
> > This definitely seems like the classic "/etc/nsswitch.conf is told to
> > look for YP servers and you are not using YP", so have a look and fix
> > nsswitch.conf if this is in fact the problem.
> 
> What I have never gotten, is why on my machines (no specific distro, just
> everything built from source and installed by me) login takes a long time,
> unless I have portmap running.
> 
> My /etc/nsswitch.conf would seem to be right:
> 
> passwd:         files
> group:          files
> shadow:         files
> 
> hosts:          files dns
> networks:       files dns
> 
> protocols:      files
> services:       files
> ethers:         files
> rpc:            files
> 
> netgroup:       files
> 
> What else could effect that?
> 
> -Chris
> --
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/