Using an SSH client (such as: Putty) to connect to a Linux server may wait 10-30 seconds before prompting for a password. Serious impact on productivity. Login is slow, log on up after normal speed, there are two main possible reasons for this situation:
1. DNS Reverse resolution problem
OPENSSH will authenticate the IP when the user logs in, it locates the hostname according to the user's IP using reverse DNS, then uses DNS to find the IP address, and finally matches the login IP is legitimate. If the client's IP does not have a domain name, or if the DNS server is slow or not, logging in will take time.
Workaround: Modify the SSHD server-side configuration on the target server and restart the sshd
- Vi/etc/ssh/sshd_config
- Usedns No
2. Turn off GSSAPI authentication for SSH
with ssh-v [email protected] You can see the following information when you log in:
- Debug1:next Authentication Method:gssapi-with-mic
- Debug1:unspecified GSS failure. Minor code may provide more information
Note:ssh-vvv [email protected] can see more detailed debug information
Workaround:
Modifying the SSHD server-side configuration
- Vi/etc/ssh/ssh_config
- Gssapiauthentication No
You can log in using ssh-o gssapiauthentication=no [email protected]
GSSAPI (Generic Security Services application Programming Interface) is a common network security system interface similar to Kerberos 5. This interface is a package of different client server security mechanisms to eliminate the different security interfaces and reduce programming difficulty. However, this interface will be problematic if the target machine has no domain name resolution.
Using Strace to see, SSH after the verification of the key, the authentication gssapi-with-mic, the first to connect to the DNS server, after which there will be other operations
- [[Email protected] ~] # SSH-VVV [email protected]
- OPENSSH_5.3P1, OpenSSL 1.0.1e-fips 2013
- Debug1:reading Configuration Data/etc/ssh/ssh_config
- debug1:applying options for *
- Debug2:ssh_connect:needpriv 0
- Debug1:connecting to 192.168.3.44 [192.168.3.44] Port 22.
- Debug1:connection established.
- debug1:permanently_set_uid:0/0
- Debug1:identity file/root/.ssh/identity type-1
- Debug1:identity file/root/.ssh/identity-cert type-1
- Debug1:identity file/root/.ssh/id_rsa type-1
- Debug1:identity file/root/.ssh/id_rsa-cert type-1
- Debug1:identity file/root/.ssh/id_dsa type-1
- Debug1:identity file/root/.ssh/id_dsa-cert type-1
- Debug1:identity file/root/.ssh/id_ecdsa type-1
- Debug1:identity file/root/.ssh/id_ecdsa-cert type-1
- Debug1:remote Protocol version 2.0, Remote software version openssh_5.3
- debug1:match:openssh_5.3 Pat Openssh*
- debug1:enabling compatibility mode for Protocol 2.0
- Debug1:local version string ssh-2.0-openssh_5.3
- DEBUG2:FD 3 Setting O_nonblock
- Debug1:ssh2_msg_kexinit sent
- Debug3:wrote 960 bytes For a total of 981
- Debug1:ssh2_msg_kexinit received
- DEBUG2:KEX_PARSE_KEXINIT:DIFFIE-HELLMAN-GROUP-EXCHANGE-SHA256,DIFFIE-HELLMAN-GROUP-EXCHANGE-SHA1, Diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
- Debug2:kex_parse_kexinit: [Email protected],[email protected],[email protected],[email PROTECTED],SSH-RSA,SSH-DSS
- DEBUG2:KEX_PARSE_KEXINIT:AES128-CTR,AES192-CTR,AES256-CTR,ARCFOUR256,ARCFOUR128,AES128-CBC,3DES-CBC, Blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
- DEBUG2:KEX_PARSE_KEXINIT:AES128-CTR,AES192-CTR,AES256-CTR,ARCFOUR256,ARCFOUR128,AES128-CBC,3DES-CBC, Blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
- debug2:kex_parse_kexinit:hmac-Md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[ Email protected],hmac-sha1-96,hmac-md5-96
- debug2:kex_parse_kexinit:hmac-Md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[ Email protected],hmac-sha1-96,hmac-md5-96
- Debug2:kex_parse_kexinit:none,[email protected],zlib
- Debug2:kex_parse_kexinit:none,[email protected],zlib
- Debug2:kex_parse_kexinit:
- Debug2:kex_parse_kexinit:
- Debug2:kex_parse_kexinit:first_kex_follows 0
- Debug2:kex_parse_kexinit:reserved 0
- DEBUG2:KEX_PARSE_KEXINIT:DIFFIE-HELLMAN-GROUP-EXCHANGE-SHA256,DIFFIE-HELLMAN-GROUP-EXCHANGE-SHA1, Diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
- Debug2:kex_parse_kexinit:ssh-rsa,ssh-dss
- DEBUG2:KEX_PARSE_KEXINIT:AES128-CTR,AES192-CTR,AES256-CTR,ARCFOUR256,ARCFOUR128,AES128-CBC,3DES-CBC, Blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
- DEBUG2:KEX_PARSE_KEXINIT:AES128-CTR,AES192-CTR,AES256-CTR,ARCFOUR256,ARCFOUR128,AES128-CBC,3DES-CBC, Blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
- debug2:kex_parse_kexinit:hmac-Md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[ Email protected],hmac-sha1-96,hmac-md5-96
- debug2:kex_parse_kexinit:hmac-Md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[ Email protected],hmac-sha1-96,hmac-md5-96
- Debug2:kex_parse_kexinit:none,[email protected]
- Debug2:kex_parse_kexinit:none,[email protected]
- Debug2:kex_parse_kexinit:
- Debug2:kex_parse_kexinit:
- Debug2:kex_parse_kexinit:first_kex_follows 0
- Debug2:kex_parse_kexinit:reserved 0
- Debug2:mac_setup:found hmac-MD5
- Debug1:kex:server->client aes128-ctr hmac-MD5 None
- Debug2:mac_setup:found hmac-MD5
- Debug1:kex:client->server aes128-ctr hmac-MD5 None
- Debug1:ssh2_msg_kex_dh_gex_request (1024<1024<8192) sent
- Debug1:expecting Ssh2_msg_kex_dh_gex_group
- Debug3:wrote bytes for a total of 1005
- Debug2:dh_gen_key:priv Key Bits set:120/256
- Debug2:bits set:506/1024
- Debug1:ssh2_msg_kex_dh_gex_init sent
- Debug1:expecting ssh2_msg_kex_dh_gex_reply
- Debug3:wrote 144 bytes For a total of 1149
- Debug3:check_host_in_hostfile:host 192.168.3.44 filename/root/.ssh/known_hosts
- Debug3:check_host_in_hostfile:host 192.168.3.44 filename/root/.ssh/known_hosts
- Debug3:check_host_in_hostfile:match Line 8
- Debug1:host ' 192.168.3.44 ' is known and matches the RSA Host key.
- Debug1:found Key In/root/.ssh/known_hosts:8
- Debug2:bits set:527/1024
- Debug1:ssh_rsa_verify:signature correct
- Debug2:kex_derive_keys
- Debug2:set_newkeys: Mode 1
- Debug1:ssh2_msg_newkeys sent
- Debug1:expecting Ssh2_msg_newkeys
- Debug3:wrote bytes for a total of 1165
- Debug2:set_newkeys: mode 0
- Debug1:ssh2_msg_newkeys received
- Debug1:ssh2_msg_service_request sent
- Debug3:wrote bytes for a total of 1213
- Debug2:service_accept:ssh-userauth
- Debug1:ssh2_msg_service_accept received
- Debug2:key:/root/.ssh/identity ((nil))
- Debug2:key:/root/.ssh/id_rsa ((nil))
- Debug2:key:/root/.ssh/id_dsa ((nil))
- Debug2:key:/root/.ssh/id_ecdsa ((nil))
- Debug3:wrote bytes for a total of 1277
- Debug1:authentications that can Continue:publickey,gssapi-keyex,gssapi-with-mic,password
- Debug3:start over, passed a different list Publickey,gssapi-keyex,gssapi-with-mic,password
- Debug3:preferred Gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
- Debug3:authmethod_lookup Gssapi-keyex
- Debug3:remaining Preferred:gssapi-with-mic,publickey,keyboard-interactive,password
- Debug3:authmethod_is_enabled Gssapi-keyex
- Debug1:next Authentication Method:gssapi-keyex
- Debug1:no Valid Key Exchange context
- Debug2:we did not send a packet, disable method
- Debug3:authmethod_lookup gssapi-with-mic
- Debug3:remaining Preferred:publickey,keyboard-interactive,password
- Debug3:authmethod_is_enabled gssapi-with-mic
- Debug1:next Authentication Method:gssapi-with-mic
- Debug3:trying to reverse map address 192.168.3.44.
- Debug1:unspecified GSS failure. Minor code may provide more information
- Cannot determine realm for numeric host address
- Debug1:unspecified GSS failure. Minor code may provide more information
- Cannot determine realm for numeric host address
- Debug1:unspecified GSS failure. Minor code may provide more information
- Debug1:unspecified GSS failure. Minor code may provide more information
- Cannot determine realm for numeric host address
- Debug2:we did not send a packet, disable method
- Debug3:authmethod_lookup PublicKey
- Debug3:remaining Preferred:keyboard-interactive,password
- Debug3:authmethod_is_enabled PublicKey
- Debug1:next Authentication Method:publickey
- Debug1:trying private key:/root/.ssh/identity
- Debug3:no such identity:/root/.ssh/identity
- Debug1:trying private key:/root/.ssh/id_rsa
- Debug3:no such identity:/root/.ssh/id_rsa
- Debug1:trying private key:/ROOT/.SSH/ID_DSA
- Debug3:no such identity:/ROOT/.SSH/ID_DSA
- Debug1:trying private key:/ROOT/.SSH/ID_ECDSA
- Debug3:no such identity:/ROOT/.SSH/ID_ECDSA
- Debug2:we did not send a packet, disable method
- Debug3:authmethod_lookup Password
- Debug3:remaining preferred:, password
- debug3:authmethod_is_enabled Password
- Debug1:next Authentication Method:password
- [email protected] ' s password:
This article was reproduced in: https://blog.linuxeye.com/420.html
"Go" SSH login very slow workaround
