Very slow password validation

[Tomas Mraz]

On Wed, 2008-08-13 at 21:22 -0400, Jim Cornette wrote:
> Tomas Mraz wrote:
> > On Thu, 2008-07-31 at 20:20 -0400, Jim Cornette wrote:
> >> Jim Cornette wrote:
> >>> Tomas Mraz wrote:
> >>>>> AS with Clyde, it is in gnome-terminal issuing the su - command
> >>>>> I have ssh disabled.
> >>>> Can you strace the process and see where it is waiting? You will have to
> >>>> attach the strace to the su process from another root shell of course.
> >>> It appears to be hanging only on the first su - instance. When I logged 
> >>> in one terminal by su - and logged in the second terminal with su to 
> >>> attach, it was fairly quick.
> >>>
> >>> If the attachment does not give you a clue, I'll log in a regular root 
> >>> console to attach. See text file attached.
> >>>
> >>> Jim
> >>>
> >> It looks like time to change the root password :-)
> > 
> > I also didn't ask you to attach the full strace but told you that you
> > should use it to find out where the process is waiting. :-) But I should
> > have write a warning that the strace will contain the password so some
> > testing password should be used.
> > 
> > Also attaching a gdb to the process and printing a backtrace (especially
> > with relevant -debuginfo) packages can help to find out where the
> > process is waiting.
> > 
> 
> Sorry for posting the whole trace, If I would have skimmed through the 
> trace first I would have noted the password was in it and not have 
> carelessly posted the info.
> 
> Anyway, the problem seems to be an initial login as root, even at 
> runlevel 3 and on a vt. Later logins do not seem to have the delay.

You could set up pam temporarily for the console login so it would not
call any pam modules except of pam_permit.so. This could help to
eliminate the initial delay and then try to call su with the regular pam
configuration.
-- 
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
                                              Turkish proverb