HI

In the sshd logs of our oracle cluster machines (which are running RHE
linux we are seeing a Postponed record before every Accepted record. 
This happens for automated 'checks' that the machines do about once
every 10 seconds and also for manual logins.

There are two machines involved which do frequent ssh logins from the
oracle accound of one to the oracle account of the other (and vise versa).

The set up in ~oracle/.ssh looks fine on both machines, all files are
owned and readable by oracle.  Each machine has the appropriate key in
its authorized_keys file and it all works fine except for the
'Postponed' messages in the log file.

I have tried to replicate the scenario on an other pair of machines but
can not reproduce the messages (I can not fiddle on our main production
database system ;)

I have done some hours research on the web around this and have also
posted to another security list where there are plenty of clueful people.

I have found several people asking the same question but no answers.

My own research suggests that there is some sort of asynchronous check
happening in sshd that is related to the keys and if a response is slow
then the whole process is started again and the postponed message is
written.  Googling on the message returns several sets of ssh debug
output which show the postponed messages.  They also show sshd repeating
the authentication process....

This isn't a huge issue but I don't like key systems like our database
servers generating log messages that I don't understand!

Russell.

Reply via email to