Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Everytime I ssh login to a server, it is always very slow. As a reply to my earlier post said, "grepping through a 200 line file should take millisecond or so, so I would doubt its that."

I tried ssh -vvv time@server and the output has been uploaded here. I found that when proceeding to each of these three lines in the output, it is particularly slow

debug1: Next authentication method: gssapi-with-mic 

debug1: Unspecified GSS failure.  Minor code may provide more information
Credentials cache file '/tmp/krb5cc_1000' not found 


debug1: Unspecified GSS failure.  Minor code may provide more information
Credentials cache file '/tmp/krb5cc_1000' not found 

I wonder why and what I can do to change it? Thanks and regards!


Update:

Ignacio's reply suggests me to "disable all GSS/Kerberos auth methods in your configuration."

So in /etc/ssh/ssh_config, do I have to make sure "no" is behind each of all options starting with "GSS": GSSAPIAuthentication, GSSAPIDelegateCredentials, GSSAPIKeyExchange, GSSAPITrustDNS, GSSAPIAuthentication, and GSSAPIDelegateCredentials?

Then what are the options for "Kerberos" auth method that I need to put "no" behind?

PS: following is the content of my local /etc/ssh/ssh_config with commented options not copied to here:

Host *
    SendEnv LANG LC_*
    HashKnownHosts yes
    GSSAPIAuthentication yes
    GSSAPIDelegateCredentials no
share|improve this question
    
How many times are you going to ask the same question? –  Paul Tomblin Jan 19 '12 at 0:36
    
    
@PaulTomblin: Not many. :-) –  Tim Jan 19 '12 at 1:46
    
possible duplicate of How to speed my too-slow ssh login? –  Gilles Jan 19 '12 at 23:37
    
@Gilles: Thanks, I fixed my problem from that post. Before I had to wait the cursor to flash 30 times, now it takes the cursor to flash 7 times. (1) Is it now a normal speed to wait the cursor to flash 7 times? (2) Why does it work by commenting out GSSAPIAuthentication yes and GSSAPIDelegateCredentials no? –  Tim Jan 20 '12 at 0:18

4 Answers 4

For me I needed GSSAPI and I didn't want to turn off reverse DNS lookups, that just didn't seem like a good idea so I checked out the man page for resolv.conf. It turns out that a firewall between me and the servers I was SSHing to was interfering with DNS requests because they weren't in a form that the firewall expected. In the end all I needed to do was add this line to resolv.conf on the servers that I was SSHing to -

options single-request-reopen​

share|improve this answer

Could it be ssh/etc/ssh_prng_cmds? There is a job in ssh that runs a series of commands to make stuff random as you log in. One of those commands is probably taking too long because it is doing something that is silly on your computer. The only thing I can think of now is that ssh requires the computer to cut down the largest tree in the forest with......

a HERRING.

So "run" some of these commands from a prompt and find out with one takes a long time to respond. Comment out THAT one.

share|improve this answer

UseDNS no and CheckHostIP no should speed up things, too.

It is also a good security measure to allow protocol 2 only. If you don't need IPv6 disable it (AddressFamily).

share|improve this answer
debug1: Next authentication method: gssapi-with-mic

That's Kerberos. Disable all GSS/Kerberos auth methods in your configuration. See the ssh_config(5) man page, PreferredAuthentications option, for more details.

share|improve this answer
    
Thanks! By "your configuration", you mean my local one or the remote server's? –  Tim Jan 19 '12 at 1:45
    
PreferredAuthentications is on the client. On the server, use GSSAPIAuthentication instead. –  Ignacio Vazquez-Abrams Jan 19 '12 at 1:48
    
Thanks! So in /etc/ssh/ssh_config, (1) do I have to make sure "no" is behind each of all options starting with "GSS": GSSAPIAuthentication, GSSAPIDelegateCredentials, GSSAPIKeyExchange, GSSAPITrustDNS, GSSAPIAuthentication, and GSSAPIDelegateCredentials? (2) what are the options for "Kerberos" auth method that I need to put "no" behind? PS: I just updated my post with the content of my local /etc/ssh/ssh_config. –  Tim Jan 19 '12 at 2:02
    
1) Modifying PreferredAuthentications is enough. 2. Kerberos uses GSS; disabling GSS is enough. –  Ignacio Vazquez-Abrams Jan 19 '12 at 2:06
    
Thanks! May I ask how to modify PreferredAuthentications? I cannot find it in ssh_config(5) manpage –  Tim Jan 19 '12 at 2:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.