Putty - ssh to ubuntu server 9.10
 

Hi,
I can't figure out why I keep getting kicked out of the ssh session almost immediately after login to an ubuntu 9.10 server (32bit).
See the screenshot. I just installed this server and didn't make any ssh config options. I thought it would work right away.
When I ping that server I get sporadic responses where some packets are lost. It's an old Dell poweredge 1400:

PING 10.45.48.104 (10.45.48.104) 56(84) bytes of data.
64 bytes from 10.45.48.104: icmp_seq=1 ttl=64 time=7.29 ms
64 bytes from 10.45.48.104: icmp_seq=2 ttl=64 time=0.353 ms
64 bytes from 10.45.48.104: icmp_seq=3 ttl=64 time=0.403 ms
64 bytes from 10.45.48.104: icmp_seq=4 ttl=64 time=0.389 ms
64 bytes from 10.45.48.104: icmp_seq=5 ttl=64 time=0.441 ms
64 bytes from 10.45.48.104: icmp_seq=6 ttl=64 time=1.43 ms
64 bytes from 10.45.48.104: icmp_seq=50 ttl=64 time=1.58 ms
64 bytes from 10.45.48.104: icmp_seq=51 ttl=64 time=1.58 ms
64 bytes from 10.45.48.104: icmp_seq=52 ttl=64 time=1.58 ms
64 bytes from 10.45.48.104: icmp_seq=53 ttl=64 time=1.56 ms
64 bytes from 10.45.48.104: icmp_seq=54 ttl=64 time=1.59 ms

--- 10.45.48.104 ping statistics ---
54 packets transmitted, 11 received, 79% packet loss, time 53272ms
rtt min/avg/max/mdev = 0.353/1.656/7.293/1.863 ms

where should I start troubleshooting? Authentication? Hardware?

IMO more likely to be hardware. If you look at "ifconfig eth0" does it show lots of dropped packets or packets with errors?

Hmmm. I see errors. And I do see the ipv6 address. Could this be the source of the problem? Can it be the network driver?

Last login: Fri Apr 2 19:40:07 2010 from 10.45.31.189
samuel@dev-ub910-01:~$ ifconfig
eth0 Link encap:Ethernet HWaddr 00:b0:d0:fe:27:ed
inet addr:10.45.48.104 Bcast:10.45.255.255 Mask:255.255.0.0
inet6 addr: fe80::2b0:d0ff:fefe:27ed/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:431026 errors:0 dropped:0 overruns:0 frame:0
TX packets:2013 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:38396328 (38.3 MB) TX bytes:216439 (216.4 KB)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:4 errors:0 dropped:0 overruns:0 frame:0
TX packets:4 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:272 (272.0 B) TX bytes:272 (272.0 B)

That all looks fine, 431026 packets, 0 errors, 0 dropped and 0 overruns.

How do you know whether it is the server or the client? You probably want to run a few checks to see if you can see which is causing the problem. First thing I would do (before even looking in the logs), is try ssh from the server to itself, using ssh localhost - if that has no problems, try another client PC (if available) to see if you have the same problems. Also which user are your trying to login as? Have you tried logging in locally (su'ing) as the same user - e.g. one thing that would give the symptoms you describe would be if the user's shell was set to '/bin/false' - such as the user 'mysql'.

I you determine that the problem lies with your server, then look in your logs, probably starting with /var/log/auth.log, typically you would expect to see something like the following for a successful session:
auth.log might be clearer if you grep it for sshd e.g. 'grep sshd /var/log/auth.log'

If the problem isn't with SSH, but is on your server, you probably want to review all relevant logs - if you aren't sure which files might be relevent, try 'ls -ltr /var/log' to see which log files have changed recently (they will be listed in order since last changed). Ignore wtmp and lastlog as they are binary files. You can also discount any file which has not changed in the last few minutes.

Replaced the network card. It's all good now. Thanks everyone.