From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-lf1-x135.google.com (mail-lf1-x135.google.com [IPv6:2a00:1450:4864:20::135]) by sourceware.org (Postfix) with ESMTPS id 9A8773894C3B for ; Fri, 22 Jan 2021 19:07:24 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 9A8773894C3B Received: by mail-lf1-x135.google.com with SMTP id b26so8985219lff.9 for ; Fri, 22 Jan 2021 11:07:24 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:to:from:subject:message-id:date:user-agent :mime-version:content-language:content-transfer-encoding; bh=jM4mCqnotH3RD1jiSQDmAiPqoxCEpvSJhsGvaEXIB0Y=; b=YRhdZLdKi85QmFbp37V5UBrl+wj6e/fmIFZYsWxBB3f8iK7DjFKaIIprTREPyZiWmX 5aFQnpBQ8op9LOj9UEotyxU8Qzez1hq0A/f3A75ZDqqd+C8Wb3OxGct2BlHkPPQjAIVp cCUqK7J7/jMArl+z2ZrOFGEmLj2/9C5chCGpxLQ/bllbmsRUn+tAkkw7CFJmqw9XADXV YjIt+v3kEzAX2i7hQDvsxsaD6kAaGDmvNEiQFXwbgj5GNX7fknIA6EdPknRgjxGHTNHa nRxTk6db+rG4FDWM+k4vP1MG033lxSziq5bx1iCPZlgtKvnCB6yhyTXymXf0e7lNj7Gk 07zQ== X-Gm-Message-State: AOAM530lh+JPG0013ZJPGvmmsecETAErQG3k84S1iW+NeKD3ABm7wWEv YYpk03Dee/StZ1uJU4wy/rLUFBUREe4= X-Google-Smtp-Source: ABdhPJwcRm+PL9fw7TAPlLWOY8/PSYAem48fN1iyYF/EYbDJ35JUgI0ouh4tMtslMS4UTTDWRVGe+w== X-Received: by 2002:ac2:593a:: with SMTP id v26mr2725367lfi.591.1611342442829; Fri, 22 Jan 2021 11:07:22 -0800 (PST) Received: from [192.168.1.107] ([93.100.116.8]) by smtp.googlemail.com with ESMTPSA id u17sm527834ljj.2.2021.01.22.11.07.21 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 22 Jan 2021 11:07:21 -0800 (PST) To: cygwin@cygwin.com From: basinilya@gmail.com Subject: sshd.exe waits repeatedly with SYN_SENT for inaccessible ldap Message-ID: <67ec7d7f-cac0-3a2a-4f85-1d42f0864b46@gmail.com> Date: Fri, 22 Jan 2021 22:07:18 +0300 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:78.0) Gecko/20100101 Thunderbird/78.6.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-1.7 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: cygwin@cygwin.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: General Cygwin discussions and problem reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Jan 2021 19:07:26 -0000 Hi. The problem first appeared ten days ago. It now takes minutes to login as a domain user. Tcpview shows that sshd.exe is trying to connect an inaccessible server on the port 389 (ldap). If I close the socket using Tcpview, successful login happens sooner. Both password and public key logins are affected, but with a public key sshd.exe tries to connect that server multiple times. Also, if I don't close the sockets repeatedly, ssh disconnects from the SSH server after 2 minutes of silence before the "last login" line appears: $ time ssh -vvv localhost ... debug1: Offering public key: debug3: send packet: type 50 debug2: we sent a publickey packet, wait for reply debug3: receive packet: type 60 debug1: Server accepts key: debug3: sign_and_send_pubkey: RSA debug3: sign_and_send_pubkey: signing using rsa-sha2-512 debug3: send packet: type 50 Connection closed by ::1 port 22 real 2m0.292s user 0m0.045s sys 0m0.122s Besedes, sshd.exe has a live connection on port 389 to another server all the time. I can't see anything interesting in sshd log. At least the ldap ip address does not appear in the log. ... sshd: PID 1786: debug1: temporarily_use_uid: 1087042/1049089 (e=18/18) sshd: PID 1786: debug1: trying public key file /home/basin/.ssh/authorized_keys ... sshd: PID 1786: debug1: temporarily_use_uid: 1087042/1049089 (e=18/18) ... sshd: PID 1786: debug1: trying public key file /home/basin/.ssh/authorized_keys ... sshd: PID 1786: debug1: monitor_child_preauth: basin has been authenticated by privileged process ... sshd: PID 1652: debug1: main_sigchld_handler: Child exited BTW, is it possible to make sshd write to a log file instead of Windows Event Log?