0

When I connect to my Debian server via ssh, the ssh client tries to establish a IPv6 connection. This fails after a long timeout (~30sec), then falls back to IPv4, which then succeeds, and I'm prompted for a password.

This is quite annoying, because I often miss the time I can enter the password (password timeout feels really short in comparison), and I have to sit through this again.

This happens both on Windows via putty and on my Debian machine using the standard ssh client.

I like to fix this either by making the IPv6 connection working or by directly connecting via IPv4.

  • How can I find out why I'm unable to connect via IPv6?
  • How can I configure my ssh client to connect via IPv4?

Here is what my output of ssh is like (changed personal data)

> ssh -v someuser@somedomain.com
OpenSSH_6.9p1 Debian-2, OpenSSL 1.0.2d 9 Jul 2015
debug1: Reading configuration data /home/someuser/.ssh/config
debug1: /home/someuser/.ssh/config line 12: Applying options for somedomain.com
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to somedomain.com [1234:1234:1234:1234::1] port 12345.

after this ssh waits for ~30sec (as mentioned above), and then falls back to IPv4 and I can login as usual.

update

I did some testing, and I think the server is not setup correctly for IPv6 (although ping6 ::1 and ssh -6 ::1 worked). For now I will configure my ssh clients to use IPv4 until I figured out how to fix IPv6 on my server.

  • Could you add the output of ssh -vvvvv someuser@somedomain.com? – Daniel Nov 4 '15 at 15:53
  • 2
    You can always use the -4 option to force an IPv4 connection, so you get something like ssh -4 host.example.com. But obviously fixing IPv6 connections is the cleaner approach. – Oldskool Nov 4 '15 at 15:57
  • 2
    For your system to try to use IPv6 there have to be at least three things: 1. the hostname your are connecting to has an AAAA DNS record. 2. Your local system thinks it has IPv6 connectivity. 3. Your IPv6 connectivity doesn't work and you are not getting proper ICMPv6 errors that would make your system stop trying IPv6 – Sander Steffann Nov 4 '15 at 15:57
0

The best approach, in my opinion, is to get things working (rather than working around what isn't working). So, fix IPv6.

Does ping6/ping for IPv6 work? Can you ssh to "::1"? Does firewall rules permit the incoming traffic to the IPv6 address?

Is Reverse DNS set up? If not, OpenBSD FAQ about Reverse DNS specifically describes this behavior in OpenSSH, and adjusting that by getting Reverse DNS working or by adding entries to a /etc/hosts file.

Or, if you'd like to not follow my earlier advice of getting things to work instead of performing a workaround, you could disable the lookups (rather than make the lookups succeed).

This guide says to add UseDNS=no to the sshd_config file (and then don't forget to have sshd reload the config), and also have sshd be started with the "-u0" option.

  • I'm more interested in fixing the problem than to work around it. So ssh to ::1 worked. But right now I'm trying to find a way to test IPv6 connectivity, since I have no machine for which I'm sure its IPv6 setup is correct. – mic Nov 5 '15 at 10:23
0

This should help you disable IPv6, which should remove that delay (by forcing IPv4 system-wide): https://kb.iu.edu/d/aqig


Windows 7 and Vista

From the Start menu, select Control Panel. Make sure you are in the Large or Small icons view (Windows 7), or Classic View (Vista).
Open Network and Sharing Center.
On the left, select Change adapter settings (Windows 7) or Manage network connections (Vista).
Right-click the connection for which you want to disable IPv6, and select Properties.
Uncheck Internet Protocol Version 6 (TCP/IPv6) and click OK.



On Debian based Linux: http://www.binarytides.com/disable-ipv6-ubuntu/
Disable Ipv6 - Method 1

Edit the file - /etc/sysctl.conf

$ sudo gedit /etc/sysctl.conf

And fill in the following lines at the end of that file

# IPv6 disabled
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1

Save the file and close it

Restart sysctl with

$ sudo sysctl -p

Check the output of ifconfig again and there should be no ipv6 address

$ ifconfig
eth0      Link encap:Ethernet  HWaddr 08:00:27:5f:28:8b  
          inet addr:192.168.1.3  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1346 errors:0 dropped:0 overruns:0 frame:0
          TX packets:965 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1501691 (1.5 MB)  TX bytes:104883 (104.8 KB)

If it does not work, then try rebooting the system and check ifconfig again.






If you don't want to disable system-wide IPv6, you should be able to disable it inside PuTTY. See http://the.earth.li/~sgtatham/putty/0.60/htmldoc/Chapter4.html#config-address-family for details. It should be under the Connection Panel -> Internet Protocol. Set this to IPv4 only.

  • 2
    Please be aware that disabling IPv6 often results in unsupported configurations these days. A better solution would be to try to find out what is going wrong. – Sander Steffann Nov 4 '15 at 15:56
  • It's possible that there's a switch somewhere in his ISP's network or the server's network that doesn't support IPv6. – Daniel Nov 4 '15 at 15:57
  • There also could be a setting in PuTTY to disable IPv6 ssh. – Daniel Nov 4 '15 at 15:57
  • The ssh -4 solved the timeout problem, and I was also able to find such an option in putty. But I don't want to disable IPv6. I'm more interested in finding and fixing the problem. – mic Nov 5 '15 at 10:19

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.