12

Every time I ssh login to a server, it is always very slow. As a reply to my earlier post said, "grepping through a 200 line file should take millisecond or so, so I would doubt it's that."

I tried ssh -vvv time@server and the output has been uploaded here. I found that when proceeding to each of these three lines in the output, it is particularly slow:

debug1: Next authentication method: gssapi-with-mic 

debug1: Unspecified GSS failure.  Minor code may provide more information
Credentials cache file '/tmp/krb5cc_1000' not found 


debug1: Unspecified GSS failure.  Minor code may provide more information
Credentials cache file '/tmp/krb5cc_1000' not found

I wonder why and what I can do to change it? Thanks and regards!

Update:

Ignacio's reply suggests me to "disable all GSS/Kerberos auth methods in your configuration."

So in /etc/ssh/ssh_config, do I have to make sure "no" is behind each of all options starting with "GSS": GSSAPIAuthentication, GSSAPIDelegateCredentials, GSSAPIKeyExchange, GSSAPITrustDNS, GSSAPIAuthentication, and GSSAPIDelegateCredentials?

Then what are the options for "Kerberos" auth method that I need to put "no" behind?

PS: following is the content of my local /etc/ssh/ssh_config with commented options not copied to here:

Host *
    SendEnv LANG LC_*
    HashKnownHosts yes
    GSSAPIAuthentication yes
    GSSAPIDelegateCredentials no
Improve this question
6
  • How many times are you going to ask the same question?
    – Paul Tomblin
    Jan 19, 2012 at 0:36
  • unix.stackexchange.com/questions/29395
    – Paul Tomblin
    Jan 19, 2012 at 0:38
  • @PaulTomblin: Not many. :-)
    – Tim
    Jan 19, 2012 at 1:46
  • possible duplicate of How to speed my too-slow ssh login?
    – Gilles 'SO- stop being evil'
    Jan 19, 2012 at 23:37
  • @Gilles: Thanks, I fixed my problem from that post. Before I had to wait the cursor to flash 30 times, now it takes the cursor to flash 7 times. (1) Is it now a normal speed to wait the cursor to flash 7 times? (2) Why does it work by commenting out GSSAPIAuthentication yes and GSSAPIDelegateCredentials no?
    – Tim
    Jan 20, 2012 at 0:18

4 Answers 4

Reset to default
15 
debug1: Next authentication method: gssapi-with-mic

That's Kerberos. Disable all GSS/Kerberos auth methods in your configuration. See the ssh_config(5) man page, PreferredAuthentications option, for more details.

Improve this answer
10
  • Thanks! By "your configuration", you mean my local one or the remote server's?
    – Tim
    Jan 19, 2012 at 1:45
  • PreferredAuthentications is on the client. On the server, use GSSAPIAuthentication instead.
    – Ignacio Vazquez-Abrams
    Jan 19, 2012 at 1:48
  • 1
    Thanks! So in /etc/ssh/ssh_config, (1) do I have to make sure "no" is behind each of all options starting with "GSS": GSSAPIAuthentication, GSSAPIDelegateCredentials, GSSAPIKeyExchange, GSSAPITrustDNS, GSSAPIAuthentication, and GSSAPIDelegateCredentials? (2) what are the options for "Kerberos" auth method that I need to put "no" behind? PS: I just updated my post with the content of my local /etc/ssh/ssh_config.
    – Tim
    Jan 19, 2012 at 2:02
  • 1
    1) Modifying PreferredAuthentications is enough. 2. Kerberos uses GSS; disabling GSS is enough.
    – Ignacio Vazquez-Abrams
    Jan 19, 2012 at 2:06
  • 1
    Leverage the SSH client config.d directory: Create a file /etc/ssh/ssh_config.d/10-gssapiauthentication-no.conf with the following content: GSSAPIAuthentication no ... And notice this is with directory /etc/ssh/ssh_config.d/, ... not /etc/ssh/sshd_config.d/ ... Because this is an SSH client configuration, not an SSH server configuration.
    – Abdull
    Feb 7 at 18:22
3

UseDNS no and CheckHostIP no should speed up things, too.

It is also a good security measure to allow protocol 2 only. If you don't need IPv6 disable it (AddressFamily).

Improve this answer
1

Could it be ssh/etc/ssh_prng_cmds? There is a job in ssh that runs a series of commands to make stuff random as you log in. One of those commands is probably taking too long because it is doing something that is silly on your computer. The only thing I can think of now is that ssh requires the computer to cut down the largest tree in the forest with......

a HERRING.

So "run" some of these commands from a prompt and find out with one takes a long time to respond. Comment out THAT one.

Improve this answer
1

For me I needed GSSAPI and I didn't want to turn off reverse DNS lookups, that just didn't seem like a good idea so I checked out the man page for resolv.conf. It turns out that a firewall between me and the servers I was SSHing to was interfering with DNS requests because they weren't in a form that the firewall expected. In the end all I needed to do was add this line to resolv.conf on the servers that I was SSHing to -

options single-request-reopen​

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .