{"action":"created","issue":{"url":"https://api.github.com/repos/micheloosterhof/cowrie/issues/81","labels_url":"https://api.github.com/repos/micheloosterhof/cowrie/issues/81/labels{/name}","comments_url":"https://api.github.com/repos/micheloosterhof/cowrie/issues/81/comments","events_url":"https://api.github.com/repos/micheloosterhof/cowrie/issues/81/events","html_url":"https://github.com/micheloosterhof/cowrie/issues/81","id":121226085,"number":81,"title":"Authentication takes long time","user":{"login":"jeanbruder","id":7450442,"avatar_url":"https://avatars.githubusercontent.com/u/7450442?v=3","gravatar_id":"","url":"https://api.github.com/users/jeanbruder","html_url":"https://github.com/jeanbruder","followers_url":"https://api.github.com/users/jeanbruder/followers","following_url":"https://api.github.com/users/jeanbruder/following{/other_user}","gists_url":"https://api.github.com/users/jeanbruder/gists{/gist_id}","starred_url":"https://api.github.com/users/jeanbruder/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jeanbruder/subscriptions","organizations_url":"https://api.github.com/users/jeanbruder/orgs","repos_url":"https://api.github.com/users/jeanbruder/repos","events_url":"https://api.github.com/users/jeanbruder/events{/privacy}","received_events_url":"https://api.github.com/users/jeanbruder/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/micheloosterhof/cowrie/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-12-09T12:25:25Z","updated_at":"2015-12-18T07:36:03Z","closed_at":null,"body":"2015-12-09 13:19:23+0100 [cowrie.core.ssh.HoneyPotSSHFactory] New connection: X.X.X.X:10806 (192.168.1.10:2222) [session: 1]\r\n2015-12-09 13:19:24+0100 [HoneyPotTransport,1,X.X.X.X] Remote SSH version: SSH-2.0-PuTTY_Release_0.63\r\n2015-12-09 13:19:24+0100 [HoneyPotTransport,1,X.X.X.X] kex alg, key alg: diffie-hellman-group-exchange-sha1 ssh-rsa\r\n2015-12-09 13:19:24+0100 [HoneyPotTransport,1,X.X.X.X] outgoing: aes256-ctr hmac-sha1 none\r\n2015-12-09 13:19:24+0100 [HoneyPotTransport,1,X.X.X.X] incoming: aes256-ctr hmac-sha1 none\r\n2015-12-09 13:19:26+0100 [HoneyPotTransport,1,X.X.X.X] NEW KEYS\r\n2015-12-09 13:19:26+0100 [HoneyPotTransport,1,X.X.X.X] starting service ssh-userauth\r\n2015-12-09 13:19:26+0100 [SSHService ssh-userauth on HoneyPotTransport,1,X.X.X.X] root trying auth none\r\n2015-12-09 13:19:26+0100 [SSHService ssh-userauth on HoneyPotTransport,1,X.X.X.X] root trying auth keyboard-interactive\r\n2015-12-09 **13:19:28+0100** [SSHService ssh-userauth on HoneyPotTransport,1,X.X.X.X] login attempt [root/root] succeeded\r\n2015-12-09 **13:19:51+0100** [SSHService ssh-userauth on HoneyPotTransport,1,X.X.X.X] root authenticated with keyboard-interactive\r\n2015-12-09 13:19:51+0100 [SSHService ssh-userauth on HoneyPotTransport,1,X.X.X.X] starting service ssh-connection\r\n2015-12-09 13:19:52+0100 [SSHService ssh-connection on HoneyPotTransport,1,X.X.X.X] got channel session request\r\n2015-12-09 13:19:52+0100 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,1,X.X.X.X] channel open\r\n2015-12-09 13:19:52+0100 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,1,X.X.X.X] pty request: xterm (57, 202, 0, 0)\r\n2015-12-09 13:19:52+0100 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,1,X.X.X.X] Terminal Size: 57 202\r\n2015-12-09 13:19:52+0100 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,1,X.X.X.X] getting shell\r\n2015-12-09 13:19:52+0100 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,1,X.X.X.X] openshell: <twisted.conch.ssh.session.SSHSessionProcessProtocol instance at 0xb59cf1c0>\r\n2015-12-09 13:19:52+0100 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,1,X.X.X.X] Opening TTY Log: log/tty/20151209-131952-5d806ca7-0i.log\r\n\r\nHow can we discover why the authentication takes such a long time ?\r\n\r\nThx"},"comment":{"url":"https://api.github.com/repos/micheloosterhof/cowrie/issues/comments/165703625","html_url":"https://github.com/micheloosterhof/cowrie/issues/81#issuecomment-165703625","issue_url":"https://api.github.com/repos/micheloosterhof/cowrie/issues/81","id":165703625,"user":{"login":"micheloosterhof","id":1063043,"avatar_url":"https://avatars.githubusercontent.com/u/1063043?v=3","gravatar_id":"","url":"https://api.github.com/users/micheloosterhof","html_url":"https://github.com/micheloosterhof","followers_url":"https://api.github.com/users/micheloosterhof/followers","following_url":"https://api.github.com/users/micheloosterhof/following{/other_user}","gists_url":"https://api.github.com/users/micheloosterhof/gists{/gist_id}","starred_url":"https://api.github.com/users/micheloosterhof/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/micheloosterhof/subscriptions","organizations_url":"https://api.github.com/users/micheloosterhof/orgs","repos_url":"https://api.github.com/users/micheloosterhof/repos","events_url":"https://api.github.com/users/micheloosterhof/events{/privacy}","received_events_url":"https://api.github.com/users/micheloosterhof/received_events","type":"User","site_admin":false},"created_at":"2015-12-18T07:36:03Z","updated_at":"2015-12-18T07:36:03Z","body":"It's the entire directory tree that's loaded into memory, so all the file names, permissions, directories, etc. Not the file contents. (Most files do not have contents anyway).\r\n\r\nI do think there's some memory leakage, so some of this file system data is not deleted when the user logs out or disconnects. I've been looking into this, but it's not fixed yet."}}