After upgrading to Debian 7.4 password authentication from any service take a long time. This is true for SSH logins, sudo'ing and authentication with dovecot (which is configured to use PAM).
I am able to reverse lookup DNS entries, this does not seem to be the problem. It feels like some authentication mechanism is running into a timeout. I have tried to enable pam_debug, but I don't see any debugging output going anywhere.
Here is an example of how long it takes to do a sudo (with a password prompt, during the time that sudo caches the password, it works instantly):
ceicke@h1633420:~$ time sudo who [sudo] password for ceicke: ceicke pts/0 2014-08-01 09:19 (80.131.XXX.XXX) real 0m27.976s user 0m0.009s sys 0m0.014s
Also SSHing into the box with my private key works instantly. So really the password checking process takes a long time.
I am a little lost on what else I can try, especially since the PAM module is very very silent about what it is doing.
Here is the output of strace: http://pastebin.com/dRvqsrcd
There are a lot of calls of
time(null) which I guess gets the current Unix timestamp. Seems like something is actively checking for a timeout.
I notice two things:
time(null)call is often preceded with an open call to
/dev/urandom, can it be that my server is waiting to gather enough entropy?
- there are a lot of references to
krb5in various places. I do not use Kerberos to authenticate, can I simply take out
pam_krb5.sofrom my pam configs?
I do not have a lot of experiences readying strace output, maybe you can see more?
Entropy is fairly low on the server, between 100 - 200.