Log in with AFP brings down Leopard Server

Question

Hello everyone. I'm not really sure what the problem is here so I'll do my best to explain how I got here. The problem is that when I accessed an afp share with the Finder, it made the entire server unresponsive for at least 10 minutes.
Our server is located in a datacenter outside of our office. We have multiple offices and have mobile users, so we chose to colocate it elsewhere. We haven't configured any client machines to use Kerberos or anything like that. I've just enabled a handful of services and we're going to log into them normally. I created all of the users in the Workgroup Manager and discovered that unless their machines are set up to authenticate against Open Directory at login, there's not really a good way to change the password. But even trying to dig deeper I was stumped- I created a test user and added the Open Directory server via Directory Utility to a spare machine. I was able to log into this machine with the account information on the Leopard Server and it was extremely slow because it was not a Mobile account. After configuring the Mobile account, I tried to change the password in system preferences but I would get an error. I found the option in WGM to change the password at the next log on but I was never prompted to change when I logged in. I moved onto another project and left it for later.
The other day I connected to an AFP share in the Finder as the test user and I was prompted to change my password! I figured this would be the best way to have users set their password: enable the change password at next login option and have everyone use AFP once to change their passwords before using other Leopard services. So I selected 17 users and applied that setting and saved it. Now, here's where the huge problem lies. Three times now I have logged in and gotten an error about the username or password being incorrect and then after entering it a second time the entire server becomes unresponsive for at least 10 minutes. Here's the error in /var/log/secure.log (tubes is the name of the server)
Jul 10 15:05:51 tubes /usr/sbin/PasswordService[11150]: client response doesn't match what we generated
Jul 10 15:06:21: --- last message repeated 1 time ---
I couldn't access any services during this time; web, iCal server, Server Admin, Workgroup Manager, ssh. It wouldn't even respond to ping. The next time I was able to get in was 15 minutes later via ssh...
Jul 10 15:32:00 tubes sshd[11245]: /etc/sshd_config line 70: Unsupported option KerberosGetAFSToken
Jul 10 15:32:01 tubes sshd[11245]: Accepted publickey for alan from 66.92.171.175 port 51427 ssh2
It didn't freeze immediately any time except the last time. The first time I had successfully changed the test user's password, ejected the share, and logged back in. Then I tried as another user and it froze. The second time I tried another real user, got the change password prompt, hit cancel, selected yet another user, and it froze. The third time I went to another machine, one without the server added in Directory Utility, and yet another user still, tried to log in and it froze the system immediately. Each time it froze we were first told the username or password was incorrect.
If this adds anything to helping solve the problem, we have what I have considered a separate issue, sshd contantly pegs the processor. While there are multiple sshd threads, at least one almost always looks like this
10649 sshd 99.4% 75:29.45 1 19 51 36K 924K 1492K 21M
Restarting sshd does not seem to help, it's almost always runs at a very high percentange. It's a dual proc system so it really measures around 48% total, but that's still way too high. Could this be related? I had the network admin force quit sshd the first two times the server became unresponsive but it still took several minutes until I could log in, which hints that they aren't related. I'm having a difficult time finding the sshd logs in Leopard to look them up.
Here is some more information to hopefully help. From the AFP Access log, the third time, the user brians logged in and it looks like was immediately kicked out for whatever reason. The first time he used his full name and then the second time I had him try his short name. (I'm changing the IP here) The times don't match the secure.log file strangely, but these are in fact the actual times.
IP 11.22.333.444 - - [10/Jul/2008:15:05:51 -0500] "Login Brian Smith" -5023 0 0
IP 11.22.333.444 - - [10/Jul/2008:15:05:51 -0500] "Logout Brian Smith" -5023 0 0
IP 11.22.333.444 - - [10/Jul/2008:15:06:04 -0500] "Login brians" -5023 0 0
IP 11.22.333.444 - - [10/Jul/2008:15:06:04 -0500] "Logout brians" -5023 0 0
The AFP Error log only has a single notification, and it's from several days ago saying "server shut down." The Directory Services Server log has no entries for today and neither does the Error log. The Password Service Server log has some interesting information. A user named rose is running iCal Server is the log says that the password needs to be changed, which follows the policy I set, but of course iCal doesn't prompt you to change it.
Jul 10 2008 16:01:55 AUTH2: {0x484d6d124c59d5b30000000800000008, rose} password change required.
Jul 10 2008 16:01:55 AUTH2: {0x484d6d124c59d5b30000000800000008, rose} password change required.
Jul 10 2008 16:01:55 AUTH2: {0x484d6d124c59d5b30000000800000008, rose} password change required.
The Password Service Error log has errors on different times than my problems. It's all the same error, registration is finished error, but are likely unrelated. Also, if it helps, we're running in the Advanced configuration of Leopard Server.
I hope this isn't too long of a message, I tried to provide all the details as I am desperate to get a solution. I just need to find a way for users to change their passwords before I roll this out to everyone, and I was hoping the prompt when connecting to AFP was what I needed, but now the system is showing itself to be unstable. Any and all help would be highly appreciated.

Answer 1

I had disabled ssh, thinking that maybe the high proc usage was making the system unstable. I successfully changed the password via AFP twice for one user on my machine. I had someone else do it and it immediately brought down the server. Same thing... I'm really at a loss as to what to do, can someone provide some insight? What logs can I look at for more information? Is there anyway to tell what's happening on the machine during these 10 minutes? The logs I've looked at show nothing.