5

I am experiencing slow ssh login from a machine to a remote machine. The verbose of ssh is shown below in two broken blocks. ssh freezes for 15 seconds in the below shown block.

[root@zabbix ~]# ssh -vvv zabbix@172.18.xxx.xx
OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 172.18.xxx.xx [172.18.xxx.xx] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/identity type -1
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version Sun_SSH_1.1.4
debug1: no match: Sun_SSH_1.1.4
debug1: Enabling compatibility mode for protocol 2.0
...............
...............
debug1: Trying private key: /root/.ssh/id_dsa
debug3: no such identity: /root/.ssh/id_dsa
debug2: we did not send a packet, disable method
debug3: authmethod_lookup keyboard-interactive
debug3: remaining preferred: password
debug3: authmethod_is_enabled keyboard-interactive
debug1: Next authentication method: keyboard-interactive
debug2: userauth_kbdint
debug2: we sent a keyboard-interactive packet, wait for reply
debug3: Wrote 96 bytes for a total of 1205

ssh hangs here for approx 15 seconds and then it asks for the password

debug2: input_userauth_info_req
debug2: input_userauth_info_req: num_prompts 1
Password:

After password input, it hangs at the end of the line shown below:

debug3: packet_send2: adding 32 (len 23 padlen 9 extra_pad 64)
debug3: Wrote 80 bytes for a total of 1285
debug1: Authentication succeeded (keyboard-interactive).
debug1: channel 0: new [client-session]
debug3: ssh_session2_open: channel_new: 0
debug2: channel 0: send open
debug1: Entering interactive session.
debug3: Wrote 64 bytes for a total of 1349

After approx 15 seconds, login is done successfully.

My question is, what can I do to make this ssh attempt faster?

This login attempt is done from a RHEL 6.2 machine to a Solaris 10 machine. At the very first moment I thought that it could be a network issue but later I found that I could login without any such freezes from an another Solaris 10 machine to the same remote Solaris machine I mentioned above.

The version of SSH in the remote Solaris machine is shown below:

$ ssh -V
Sun_SSH_1.1.4, SSH protocols 1.5/2.0, OpenSSL 0x0090704f

While the version of SSH in RHEL machine is shown below:

[root@zabbix ~]# ssh -V
OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010

Please note that the remote Solaris 10 machine is a zone on Physical solaris 10 machine. Attempt to login using ssh to the Physical solaris 10 machine is very fast from the local RHEL machine. So, I suppose, this is not network issue at all.

Update: Adding below all enabled directives in sshd_config file in the remote Solaris 10 machine.

Protocol 2
Port 22
ListenAddress 0.0.0.0
AllowTcpForwarding yes
GatewayPorts yes
X11Forwarding yes
X11DisplayOffset 10
X11UseLocalhost yes
PrintMotd no
KeepAlive yes
SyslogFacility auth
LogLevel info
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
ServerKeyBits 768
KeyRegenerationInterval 3600
StrictModes yes
LoginGraceTime 600
MaxAuthTries    6
MaxAuthTriesLog 3
PermitEmptyPasswords no
PasswordAuthentication yes
PAMAuthenticationViaKBDInt yes
Subsystem   sftp    internal-sftp
IgnoreRhosts yes
RhostsAuthentication no
RhostsRSAAuthentication no
RSAAuthentication yes

Your input is highly appreciated.

Thanks

  • possible duplicate of Why SSH takes a long time to Connect – Tejas Aug 12 '14 at 12:56
  • But the logs aren't the same in both of the posts. So, the cause of the delay in ssh i am observing is not answered over there. – Rohit Aug 12 '14 at 13:38
  • Do you observe the same delay if you authenticate with a key? What user authentication methods are specified in the server configuration? If PAM is used, how is it configured? – Gilles 'SO- stop being evil' Aug 12 '14 at 22:02
  • As suggested by you, I tried the key based authentication, and unfortunately the speed of logging in still the same. :( I am going to update my post and add the excerpt from sshd_config file of the remote Solaris 10 machine. – Rohit Aug 13 '14 at 8:02
  • @Gilles: I have added excerpt from sshd_config file. Is this what you wanted to look? Please let me know if you want any more information. – Rohit Aug 13 '14 at 8:16
8

On the RHEL machine, try:

ssh -o GSSAPIAuthentication=no zabbix@172.18.xxx.xx

If that works, make it permanent by editing ~/.ssh/config and add:

GSSAPIAuthentication no

Also, check that the RHEL is visible in DNS (from the server's point of view). The server tries to check your reverse DNS resolution. If that fails, you'll suffer a delay.

This check can be disabled:

Edit /etc/ssh/sshd_config

OpenSSH: Use UseDNS no

Solaris: Use LookupClientHostnames no

Restart sshd and it should be quicker to log on.

  • Thanks for your reply. "GSSAPIAuthentication no" did not work. The other explanation shows some light on this delay. I could not find any "UseDNS" directive in the sshd_config of the remote Solaris machine. It was not mentioned in the manual also. Howerver, there is a similar directive as "LookupClientHostnames". I would try to change its value to no and let you know about the result. – Rohit Aug 12 '14 at 13:10
  • That sounds like the equivalent Solaris. If you can confirm that, I'll edit the post for future readers. – garethTheRed Aug 12 '14 at 13:13
  • Sure. That would be my pleasure. But system admin has left office and they can only change the value and confirm me back about the result :) . – Rohit Aug 12 '14 at 13:15
  • 2
    Thanks @garethTheRed :) I added "LookupClientHostnames no" in /etc/ssh/sshd_config file of the remote Solaris 10 zone and restarted sshd (svcadm restart network/ssh) and ssh login became swifter. Thanks a ton again :) – Rohit Aug 13 '14 at 12:21
  • Thanks so much for adding the Solaris variant! That helped a lot. You saved me a lot of hassle time and headache at a time I could not afford another bit rathole / diversion. – clearlight Aug 14 '15 at 5:19
1

My issue was with the /etc/resolv.conf - wrong domains to search upon, as well as non-existent DNS servers to provide lookups. Surprised I was able to login at all.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.