[vox-tech] ssh login slow with iptables

[Jack LaPlante]

Brilliant solution!  Thanks!

Samuel Merritt wrote:
> Jack LaPlante said:
> 
>>I'm setting up my nifty new dedicated web server with a firewall
>>like this: (I'm on RH9, the rpms look like the latest avail )
>>
>>iptables -F
>>iptables -A INPUT -i lo -j ACCEPT
>>iptables -A INPUT -m multiport -p tcp --dport www,ssh,sftp,smtp,10000 \
>>-j  ACCEPT
>>iptables -A INPUT -j LOG -m limit
>>iptables -A INPUT -j REJECT
>>
>>(an o'reilly setup from the linux security cookbook)
>>
>>Now, when I log in via SSH or SFTP, there is a 30 second pause while my
>>password authorizes.  It used to take a second or two.  Flush the rules
>>and the login is up to speed again.
> 
> 
> You don't allow inbound 53/udp, so your machine can't use DNS. By default,
> sshd looks up the name of the connecting machine, and it looks like the
> DNS lookup takes 30 seconds to time out.
> 
> 
>>I want to force my clients to use SFTP for all their file transfers but
>>the delay is going to be annoying.
>>
>>Any suggestions to speed up my logins?
> 
> 
> iptables -A INPUT --source $DNS_SERVER_IP_HERE -p udp --sport 53 -j ACCEPT
> 
> Assuming I got the syntax right, do that once for each DNS server you have.
> 

-- 

                  	
	


--
  Jack LaPlante
  jlaplante at pwx.com
  ________________________________________

  Pyroglyph Inc.
  ________________________________________

         Clarity and Style
         For the Digital Age
  ________________________________________
   pyroglyph.com  pwx.com  uneasychair.com