Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-5099

Slow ssh connection when using password authentication due to a large amount of "close" syscall

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done-Errata
    • Icon: Undefined Undefined
    • rhel-9.4
    • rhel-9.0.0
    • pam
    • pam-1.5.1-16.el9
    • None
    • Important
    • rhel-sst-idm-sssd
    • ssg_idm
    • 11
    • 12
    • 0
    • False
    • Hide

      None

      Show
      None
    • No
    • None
    • If docs needed, set a value
    • None

      Description of problem:
      Connecting via ssh to a server with a password is longer with RHEL 9 compared to RHEL 8

      IT seemed to be resolved in RHEL 8 with the patch pam-1.3.1-fds-closing.patch (RHBZ1737812), but the fix has been reverted upstream and is not part of the code anymore.

      Version-Release number of selected component (if applicable):
      9.0, 9.1 and 9.2

      How reproducible:
      Connect using a password authentication

      Actual results:
      With RHEL 9, sshd spends 25% of its time running the close syscall :
      RHEL 9 :
      % time seconds usecs/call calls errors syscall
      ------ ----------- ----------- --------- --------- ----------------
      71.81 1.680497 35755 47 21 wait4
      25.48 0.596416 4 131894 131057 close
      0.48 0.011248 11 979 335 openat
      0.31 0.007196 359 20 execve
      ...

      RHEL 8 :
      % time seconds usecs/call calls errors syscall
      ------ ----------- ----------- --------- --------- ----------------
      81.89 0.099364 1505 66 31 wait4
      2.64 0.003209 4 773 208 openat
      2.53 0.003064 139 22 execve
      2.26 0.002739 80 34 clone
      1.21 0.001467 27 53 socket
      1.09 0.001328 16 80 3 write
      1.04 0.001260 2 493 2 read
      0.90 0.001094 2 495 mmap

      Is it possible to recreate a patch to correct this behavior?

            [RHEL-5099] Slow ssh connection when using password authentication due to a large amount of "close" syscall

            Errata Tool added a comment -

            Since the problem described in this issue should be resolved in a recent advisory, it has been closed.

            For information on the advisory (Moderate: pam security update), and where to find the updated files, follow the link below.

            If the solution does not work for you, open a new bug report.
            https://access.redhat.com/errata/RHSA-2024:2438

            Errata Tool added a comment - Since the problem described in this issue should be resolved in a recent advisory, it has been closed. For information on the advisory (Moderate: pam security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2024:2438

            gitlab-bot added a comment -

            Iker Pedrosa mentioned this issue in a merge request of Red Hat / centos-stream / rpms / pam on branch 9_4:

            Several PAM fixes

            gitlab-bot added a comment - Iker Pedrosa mentioned this issue in a merge request of Red Hat / centos-stream / rpms / pam on branch 9_4 : Several PAM fixes

            Iker Pedrosa added a comment -

            I have changed the code and checked the behaviour of close_range(). It is slightly better, but I don't know if it will be enough for the client. Admittedly, my environment is quite limited. Would the customer be willing to use a test build to see if the behaviour improves?

            Iker Pedrosa added a comment - I have changed the code and checked the behaviour of close_range(). It is slightly better, but I don't know if it will be enough for the client. Admittedly, my environment is quite limited. Would the customer be willing to use a test build to see if the behaviour improves?

            Christophe Besson added a comment -

            Increasing the severity as the customer is awaiting for a fix.

            Christophe Besson added a comment - Increasing the severity as the customer is awaiting for a fix.

            pm-rhel added a comment -

            Issue migration from Bugzilla to Jira is in process at this time. This will be the last message in Jira copied from the Bugzilla bug.

            pm-rhel added a comment - Issue migration from Bugzilla to Jira is in process at this time. This will be the last message in Jira copied from the Bugzilla bug.

              ipedrosa@redhat.com Iker Pedrosa
              rhn-support-nbourgeo Nicolas Bourgeois
              Iker Pedrosa Iker Pedrosa
              SSSD QE SSSD QE
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: