X-MimeOLE: Produced By Microsoft Exchange V6.5
Received: by onstor-exch02.onstor.net 
	id <01C79647.72974009@onstor-exch02.onstor.net>; Mon, 14 May 2007 09:46:41 -0700
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Content-class: urn:content-classes:message
Subject: RE: ssh configuration (Defect 18513)
Date: Mon, 14 May 2007 09:46:40 -0700
Message-ID: <BB375AF679D4A34E9CA8DFA650E2B04E03B6E394@onstor-exch02.onstor.net>
In-Reply-To: <20070514084306.0a58c8bf@ripper.onstor.net>
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Thread-Topic: ssh configuration (Defect 18513)
Thread-Index: AceWPpIyUAeHhjvvTUWyrBnuezstagACH7Xw
References: <BB375AF679D4A34E9CA8DFA650E2B04E03B1BD8A@onstor-exch02.onstor.net><BB375AF679D4A34E9CA8DFA650E2B04E03B1BD8B@onstor-exch02.onstor.net> <20070514084306.0a58c8bf@ripper.onstor.net>
From: "Brian DeForest" <brian.deforest@onstor.com>
To: "Andy Sharp" <andy.sharp@onstor.com>,
	"Rendell Fong" <rendell.fong@onstor.com>
Cc: "Mike Lee" <mike.lee@onstor.com>,
	"Larry Scheer" <larry.scheer@onstor.com>

Not completely true, customers do login as root (and sometimes Customer
Support requires it to gather diag info) however in general there should
be very few concurrent root sessions.   We can, and it sounds like we
should, limit the number of SSH sessions, for root and admin logins.

-----Original Message-----
From: Andy Sharp=20
Sent: Monday, May 14, 2007 8:43 AM
To: Rendell Fong
Cc: Mike Lee; Larry Scheer; Brian DeForest
Subject: Re: ssh configuration (Defect 18513)

That's the part(s) that were missing.  Anyway, we don't and can't
support an unlimited number of logins/processes.  They should fix the
script, first, it should log into admin and do something with nfxsh,
and second, it should log back out.

Logging in as root is not done by customers, and there is no point in
testing that scenario.

Cheers,

a

On Mon, 14 May 2007 08:20:26 -0700 "Rendell Fong"
<rendell.fong@onstor.com> wrote:

> =20
>=20
> ________________________________
>=20
> From: Rendell Fong=20
> Sent: Monday, May 14, 2007 8:19 AM
> To: Mike Lee
> Subject: RE: ssh configuration (Defect 18513)
>=20
> =20
>=20
> The QA expect script is just using ssh to login as root. nfxsh is not
> being used at all.
>=20
> Because of a bug in their script it doesn't logout after killing off a
> bunch of processes.=20
>=20
> So each iteration of their their test adds an additional ssh login.=20
>=20
> =20
>=20
> ________________________________
>=20
> From: Mike Lee=20
> Sent: Monday, May 14, 2007 12:52 AM
> To: Andy Sharp; Larry Scheer
> Cc: Brian DeForest; Rendell Fong; Sandrine Boulanger; Tim Gardner
> Subject: RE: ssh configuration (Defect 18513)
>=20
> =20
>=20
> Andy:
>=20
> =20
>=20
> I'll read over the QA script more carefully tomorrow, but I don't
> recall it kicking off nfxsh.
>=20
> I think all it does is start an ssh session, in which a process ID
> search is done, followed by a kill.
>=20
> However, I could be wrong...
>=20
> =20
>=20
> Got a bad headache at the moment, so will have to call it a night now.
>=20
> =20
>=20
> Thanks.
>=20
> =20
>=20
> -Mike
>=20
> =20
>=20
> ________________________________
>=20
> From: Andy Sharp
> Sent: Mon 5/14/2007 12:47 AM
> To: Larry Scheer
> Cc: Mike Lee; Brian DeForest; Rendell Fong; Sandrine Boulanger; Tim
> Gardner
> Subject: Re: ssh configuration (Defect 18513)
>=20
> Something just doesn't add up here.  40KB per ssh login?  I guarantee
> it's a lot more than that.  But Larry's point still persists, even if
> it's 10 times that, it doesn't make sense that there are 1000 ssh
> sessions going.  Are there?  The amount of memory used by each
> instance of nfxsh is going to be in the megabytes per, and that's
> before you run any commands.  Even if you add that to the ssh usage,
> it still sounds wonky.
>=20
> Something is amiss or missing with this analysis.
>=20
> Cheers,
>=20
> a
>=20
>=20
> On Sun, 13 May 2007 21:36:12 -0700 "Larry Scheer"
> <larry.scheer@onstor.com> wrote:
>=20
> > How many concurrent SSH connections were there?
> > At 40Kbytes of memory each session, you would need 6554 sessions
> > running to exhaust 256Mbytes of memory. Are you saying the real
> > problem is a runaway process spawning SSH connections?
> >
> > When do we ever have dozens of SSH processes running running on the
> > SSC? I can't imagine hundreds much less thousands of SSH processes.
> > What are seeing that I am missing here?
> >
> > Larry
> >
> > -----Original Message-----
> > From: Mike Lee
> > Sent: Sun 5/13/2007 8:29 PM
> > To: Andy Sharp; Larry Scheer
> > Cc: Brian DeForest; Rendell Fong; Sandrine Boulanger; Tim Gardner
> > Subject: ssh configuration (Defect 18513)
> >=20
> > Gentlemen:
> >
> > Concerning that BSD panic due to kernel memory exhaustion, Rendell
> > figured out that it was due to too many concurrent ssh connections
> > to our filer, where each connection ate up 40K of memory.=20
> >
> > As such, I think we need to configure our ssh daemon to limit the
> > maximum number of concurrent connections.  I searched a bit online
> > and the only thing I found was the MaxStartups setting, but it is
> > for "concurrent unauthenticated connections".=20
> >
> > Do you know of a way to limit number of connections, authenticated
> > or unauthenticated?
> >
> > Thanks!
> >
> > -Mike
> >
> >
> > MaxStartups
> > Specifies the maximum number of concurrent unauthenticated
> > connections to the sshd daemon. Additional connections will be
> > dropped until authentication succeeds or the LoginGraceTime expires
> > for a connection. The default is 10. Alternatively, random early
> > drop can be enabled by specifying the three colon separated values
> > ``start:rate:full'' (e.g., "10:30:60"). sshd will refuse connection
> > attempts with a probability of ``rate/100'' (30%) if there are
> > currently ``start'' (10) unauthenticated connections. The
> > probability increases linearly and all connection attempts are
> > refused if the number of unauthenticated connections reaches
> > ``full'' (60).
> >
>=20
