Ssh hangs on “Last login” line

debianssh

This happened for the first time three days ago – I ssh to the server, authenticate using a password, get the welcome message but it remains hanging on the "Last login:…" line. The command line doesn't show and the server doesn't react to my input. Other services on the server keep working ok (apache, tomcat, database, ..). The box has an out-of-band management using which I was able to restart it. After the restart the ssh worked ok again and I didn't find anything suspicious in the logs. Three days later the same problem occurs on this box again, and newly on yet another server in the cluster – 100% same symptoms.

Both servers have about 2 month old installation of Debian Squeeze (6.0.2) and the problem never occurred before despite frequent ssh-ing, so it should not be a problem of settings. We haven't been installing anything new for quite some time now. I also made sure there is enough disk space on both servers. Since it started to happen all of a sudden on two servers at about the same time, I suspect some bug may have been introduced via Debian updates, yet I haven't been able to find anyone with the same problem.

Most similar issues I have found:

ssh freezes at the "Last Login Line" – in our case everything worked fine until recently, so nothing related to settings should be our problem. Diskspace checked, I couldn't check the memory but I would expect something would be in the logs if the system had been running out of it.

Remote Fedora system unresponsive, odd but consistent behavior when trying to log in – problem with high load on the server; unlike in this case, nothing changes even if I wait for 10+ minutes

Best Answer

Login using ssh -vvv and see what debug info shows up. This is odd in that the last login line is usually after the ssh session is setup. Also check your /var/log/{messages,auth,daemon} and whatever else is relevant.

Are your drives full? Is something unexpected going on with configuration? I know you didn't change it, but maybe something was compromised?