トップ > 助け合いフォーラム >CCNA/CCNP関連 >CCNA全般 >ＳＳＨのオプションの意味がわかりません。

Re: ＳＳＨのオプションの意味がわかりません。

この質問の投稿一覧へ

Re: ＳＳＨのオプションの意味がわかりません。

msg# 1.1.1.1

depth:: 3

前の投稿 - 次の投稿 | 親投稿 - 子投稿なし | 投稿日時 2013-12-19 10:29

arashi1977

居住地: 広島投稿数: 1715

引用：

timeoutのSSHコネクションのタイムアウトっていうのは、
パスワード入力失敗して、再度SSHサーバへ接続するまで
１２０秒はアクセスできないとか、そういう意味でしょうか？

せっかく疑問に思われたので、少し実験してみました。

FastEthernet0/0同士で直結したR1-R2だけの単純なトポロジです。直接流す用のコンフィグは以下の通りです。

R1:

conf t
username sshuser password CISCO
line vty 0 4
login local
transport input ssh
ip domain-name test.local
crypto key generate rsa
1024
ip ssh authentication-retries 1
ip ssh version 2
ip ssh time-out 20
interface FastEthernet0/0
ip address 192.168.12.1 255.255.255.0
no shutdown
end

R2:

conf t
interface FastEthernet0/0
ip address 192.168.12.2 255.255.255.0
no shutdown
end

で、SSHコネクション（R2->R1）のデバッグとってみました。
タイムアウト確認

R1#
*Mar  1 00:14:35.687: SSH0: starting SSH control process
*Mar  1 00:14:35.691: SSH0: sent protocol version id SSH-2.0-Cisco-1.25
*Mar  1 00:14:35.727: SSH0: protocol version id is - SSH-1.99-Cisco-1.25
*Mar  1 00:14:35.731: SSH2 0: send: len 280 (includes padlen 4)
*Mar  1 00:14:35.735: SSH2 0: SSH2_MSG_KEXINIT sent
（略）
Mar  1 00:14:38.879: SSH2 0: MAC #5 ok
*Mar  1 00:14:38.879: SSH2 0: input: padlen 18
*Mar  1 00:14:38.879: SSH2 0: received packet type 50
*Mar  1 00:14:38.891: SSH2 0: send: len 48 (includes padlen 11)
*Mar  1 00:14:38.891: SSH2 0: done calc MAC out #5
R1#
R1#
*Mar  1 00:14:58.891: SSH2 0: send: len 80 (includes padlen 15)
*Mar  1 00:14:58.891: SSH2 0: done calc MAC out #6
*Mar  1 00:14:58.891: SSH0: password authentication failed for sshuser ← authentication-timeout 20に従い、20秒でユーザー応答待ちタイムアウト
*Mar  1 00:14:58.895: SSH0: AAA authentication fail reason: Password: 
R1#
*Mar  1 00:15:00.895: SSH2 0: send: len 48 (includes padlen 8)
*Mar  1 00:15:00.895: SSH2 0: done calc MAC out #7
*Mar  1 00:15:00.899: SSH2 0: authentication failed for userid (code=0)
*Mar  1 00:15:01.003: SSH0: Session disconnected - error 0x00 ← なのでコネクション切断

試行回数オーバー

R1#
*Mar  1 00:17:17.743: SSH0: starting SSH control process
*Mar  1 00:17:17.743: SSH0: sent protocol version id SSH-2.0-Cisco-1.25
*Mar  1 00:17:17.791: SSH0: protocol version id is - SSH-1.99-Cisco-1.25
*Mar  1 00:17:17.795: SSH2 0: send: len 280 (includes padlen 4)
*Mar  1 00:17:17.799: SSH2 0: SSH2_MSG_KEXINIT sent
*Mar  1 00:17:17.819: SSH2 0: ssh_receive: 64 bytes received
*Mar  1 00:17:17.819: SSH2 0: input: packet len 280
（略）
*Mar  1 00:17:22.451: SSH2 0: done calc MAC out #5
R1#
R1#
*Mar  1 00:17:34.983: SSH2 0: ssh_receive: 52 bytes received
*Mar  1 00:17:34.983: SSH2 0: input: packet len 32
*Mar  1 00:17:34.987: SSH2 0: partial packet 16, need 16, maclen 20
*Mar  1 00:17:34.987: SSH2 0: MAC #6 ok
*Mar  1 00:17:34.987: SSH2 0: input: padlen 18
*Mar  1 00:17:34.987: SSH2 0: received packet type 61
*Mar  1 00:17:34.995: SSH0: password authentication failed for sshuser ← 1回目の試行失敗
R1#
*Mar  1 00:17:36.995: SSH2 0: send: len 48 (includes padlen 8)
*Mar  1 00:17:36.995: SSH2 0: done calc MAC out #6
*Mar  1 00:17:37.039: SSH2 0: ssh_receive: 64 bytes received
*Mar  1 00:17:37.039: SSH2 0: input: packet len 96
*Mar  1 00:17:37.043: SSH2 0: partial packet 16, need 80, maclen 20
*Mar  1 00:17:37.059: SSH2 0: ssh_receive: 52 bytes received
*Mar  1 00:17:37.059: SSH2 0: partial packet 16, need 80, maclen 20
*Mar  1 00:17:37.063: SSH2 0: MAC #7 ok
*Mar  1 00:17:37.063: SSH2 0: input: padlen 18
*Mar  1 00:17:37.063: SSH2 0: received packet type 50
*Mar  1 00:17:37.075: SSH2 0: send: len 48 (includes padlen 11)
*Mar  1 00:17:37.075: SSH2 0: done calc MAC out #7
R1#
*Mar  1 00:17:38.091: SSH2 0: ssh_receive: 52 bytes received
*Mar  1 00:17:38.095: SSH2 0: input: packet len 32
*Mar  1 00:17:38.095: SSH2 0: partial packet 16, need 16, maclen 20
*Mar  1 00:17:38.095: SSH2 0: MAC #8 ok
*Mar  1 00:17:38.095: SSH2 0: input: padlen 18
*Mar  1 00:17:38.099: SSH2 0: received packet type 61
*Mar  1 00:17:38.107: SSH0: password authentication failed for sshuser ← 2回目の試行失敗
R1#
*Mar  1 00:17:40.107: SSH2 0: authentication failed for userid (code=1)
*Mar  1 00:17:40.211: SSH0: Session disconnected - error 0x09 ← authentication-retries 1 に従い、コネクション切断

という動きですね。

なお、クライアント側で何も入力せずにいた場合、接続（Password:）表示から1分程度で切断しているのを確認しました。

R2#ssh -l sshuser 192.168.12.1

*Mar  1 00:19:52.215: SSH CLIENT0: protocol version id is - SSH-2.0-Cisco-1.25
*Mar  1 00:19:52.219: SSH CLIENT0: sent protocol version id SSH-1.99-Cisco-1.25
*Mar  1 00:19:52.223: SSH2 CLIENT 0: send: len 280 (includes padlen 4)
*Mar  1 00:19:52.227: SSH2 CLIENT 0: SSH2_MSG_KEXINIT sent
*Mar  1 00:19:52.267: SSH2 CLIENT 0: ssh_receive: 280 bytes received
（略）
*Mar  1 00:19:52.919: SSH2 CLIENT 0: input: padlen 11
*Mar  1 00:19:52.923: SSH2 CLIENT 0: received packet type 60
% Password:  timeout expired!
Password:
% Password:  timeout expired!
% Authentication failed.

[Connection to 192.168.12.1 closed by foreign host]
R2#
*Mar  1 00:20:53.623: SSH CLIENT0: Session disconnected - error 0x07

これからすると、こっちのタイムアウトは別じゃないかな？と思われます。
たぶんこれじゃないかと思うんですけど、今のところその通りの動作しないんですよねぇ。

R1#sh line vty 0
   Tty Typ     Tx/Rx    A Modem  Roty AccO AccI   Uses   Noise  Overruns   Int
     98 VTY              -    -      -    -    -      8       0     0/0       -

Line 98, Location: "", Type: ""
Length: 24 lines, Width: 80 columns
Baud rate (TX/RX) is 9600/9600
Status: Ready, No Exit Banner
Capabilities: none
Modem state: Ready
Group codes:    0
Special Chars: Escape  Hold  Stop  Start  Disconnect  Activation
                ^^x    none   -     -       none
Timeouts:      Idle EXEC    Idle Session   Modem Answer  Session   Dispatch
               00:10:00        never                        none     not set
                            Idle Session Disconnect Warning
                              never
                            Login-sequence User Response
                             00:00:30 ← これ
                            Autoselect Initial Wait
                              not set
Modem type is unknown.
Session limit is not set.
Time since activation: never
Editing is enabled.
History is enabled, history size is 20.
DNS resolution in show commands is enabled
Full user help is disabled
Allowed input transports are ssh.
Allowed output transports are lat pad telnet rlogin lapb-ta mop v120 ssh.
Preferred transport is lat.
No output characters are padded
No special data dispatching characters
------------------------------
R1(config-line)#timeout ?
  login  Timeouts related to the login sequence

R1(config-line)#timeout login ?
  response  Timeout for any user input during login sequences

R1(config-line)#timeout login response ?
  <1-300>  Timeout in seconds

投稿ツリー

ＳＳＨのオプションの意味がわかりません。 (takamoto463, 2013-12-12 15:58)
- Re: ＳＳＨのオプションの意味がわかりません。 (arashi1977, 2013-12-16 10:48)
  - Re: ＳＳＨのオプションの意味がわかりません。 (takamoto463, 2013-12-17 18:03)
    - Re: ＳＳＨのオプションの意味がわかりません。 (arashi1977, 2013-12-19 10:29)
    - Re: ＳＳＨのオプションの意味がわかりません。 (arashi1977, 2013-12-19 11:06)
      - Re: ＳＳＨのオプションの意味がわかりません。 (takamoto463, 2013-12-20 17:36)

>フォーラム検索へ