The problem is that when I ssh to my host with putty and enter user name, after that the password prompt delays. Found this is directly related to my iptables and can solve by changing default policy to ACCEPT. If default INPUT policy is ACCEPT, then password prompt is coming immediately.

Mar 13 00:05:01 server-ubuntu sshd[6154]: Connection from port 26304
Mar 13 00:05:06 server-ubuntu sshd[6154]: Failed none for acid from port 26304 ssh2

However, if default INPUT policy is DROP, I got slight delay in getting password prompt after I enter username

Mar 13 00:07:12 server-ubuntu sshd[6177]: Connection from port 26333
Mar 13 00:07:35 server-ubuntu sshd[6177]: Failed none for acid from port 26333 ssh2

For the second case, I tried to set default policy for FORWARD and OUTPUT chains to ACCEPT, but it didn't help. The only rule in this case is:

-A INPUT -i eth1 -m mac --mac-source 00:26:XX:XX:XX:XX -j ACCEPT

00:26:XX:XX:XX:XX is the mac address from which I am trying to ssh to server's LAN(eth1).

I'm sure there has to be some rule, which I can use while default INPUT chain policy is DENY in order to get password prompt immediately. I realize that the error message in the log is something normal and part of some verification procedure.

  • Looks like if I set UseDNS no in sshd config then the problem is solved. But this means that the server itself is failing to send/receive DNS queries. How to enable it from iptables? – Michael Mar 13 '11 at 5:44
  • I, too, suspect DNS. Can you post the output of iptables -L -n -v --line-numbers and cat /etc/resolv.conf so we can suggest a rule to permit DNS? – MadHatter Mar 13 '11 at 5:54
  • 1
    Well, actually just added -A INPUT -i eth0 -p UDP --sport 53 -j ACCEPT and solved the issue! Thx – Michael Mar 13 '11 at 6:00
  • Well done, you! Seriously, although breaking DNS can break lots of stuff, it can take a long time to work out what's going on. I think you should give yourself a pat on the back for some quality debugging, post that answer, and accept it - since it's right! – MadHatter Mar 13 '11 at 6:12
  • 2
    Adding -A INPUT -i eth1 -m state --state ESTABLISHED -j ACCEPT will allow return packages for outbound connections. – Mark Mar 13 '11 at 6:15

From the comments above.

The pause was caused by iptables blocking DNS queries. It was solved by opening port 53

-A INPUT -i eth1 -p UDP --sport 53 -j ACCEPT
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.