I have noticed that some Linux Servers in Network takes long time to connect using ssh.

Situations:

There are two situations I have faced:

  1. On some servers some times it takes a long time to ask for password

  2. but on other servers When I insert the password it doesn't respond . And after some time say 20 0r 30 seconds it just say Connection Closed

Detail for 1 case:

debug1: Authentications that can continue: publickey,gssapi-with-mic,password
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
Cannot determine realm for numeric host address

debug1: Unspecified GSS failure.  Minor code may provide more information
Cannot determine realm for numeric host address

debug1: Unspecified GSS failure.  Minor code may provide more information


debug1: Unspecified GSS failure.  Minor code may provide more information
Cannot determine realm for numeric host address

debug2: we did not send a packet, disable method
debug1: Next authentication method: publickey
debug1: Trying private key: /home/umairmustafa/.ssh/id_rsa
debug1: Trying private key: /home/umairmustafa/.ssh/id_dsa
debug1: Trying private key: /home/umairmustafa/.ssh/id_ecdsa
debug2: we did not send a packet, disable method
debug1: Next authentication method: password
  • 2
    Please include the last few lines from running with ssh -vv when it's taking a long time to respond. Also, if you have access to the server logs, the entries from your connecting will probably be helpful as well. As the question stands, any answer can only really be guesswork. – a CVn Feb 17 '13 at 12:05
  • Updated Question. – OmiPenguin Feb 17 '13 at 13:21
  • Much better now. I don't have an answer, but it's plenty more answerable with the additional information. +1. – a CVn Feb 17 '13 at 14:00
  • possible duplicate of How to speed my too-slow ssh login? – jasonwryan Feb 18 '13 at 0:29
up vote 44 down vote accepted

I had this same problem just this morning...

Edit your /etc/ssh/sshd_config to set GSSAPIAuthentication no

  • yes, this worked good – Silver Moon Mar 15 '14 at 5:12
  • 5
    I had to run /sbin/service sshd restart after the edit to get this to work – ContextSwitch Jul 18 '14 at 18:37
  • That worked for me (specifically, setting this on the client machine that I was trying to log in to, then restarting sshd on it). – Charles Rezk Apr 10 '16 at 17:34
  • Care to elaborate further? Why should we do this? – Timothy Pulliam Oct 10 at 15:05
  • @TimothyPulliam - A few thoughts 1) OPENssh uses this API and the underlying kerberos 5 code to provide a alternative means of authentication other than ssh_keys and I suspect most users are just using ssh_keys 2) From Oracle Linux Finding V-22473 "Allowing GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, increasing the attack surface of the system. GSSAPI authentication must be disabled unless needed." so it sounds like it improves security 3) Users who can't edit /etc/ssh/sshd_config can put it in their ~/.ssh/config file – MikeV Oct 31 at 23:53

Often this happened to me when DNS was not correctly configured, but SSH is trying to do a reverse lookup on every connect, so it might be waiting for some high timeouts. Try doing this in /etc/ssh/sshd_config:

UseDNS no

And then restart the SSH daemon. This will make it not use reverse lookups anymore.

Hope that helps.

  • 2
    That is just papering over a serious problem. Fix DNS. – vonbrand Feb 17 '13 at 13:19
  • 1
    Not necessarily, we just decided to not use DNS in our production environment. – mauro.stettler Feb 17 '13 at 13:29
  • 1
    Great idea. Just manage /etc/hosts by hand on all your machines. Wellcome back to the good old days of the nascent Internet! – vonbrand Feb 17 '13 at 13:41
  • 3
    @vonbrand Sounds like FUD. What reasoning do you have that UseDNS no is bad? – Patrick Aug 12 '14 at 16:25
  • 2
    @Patrick The option itself isn't bad, but it shouldn't be used to hide, "paper" over a DNS problem (which would probably be more important). – John WH Smith Oct 28 '14 at 17:51

If you do not want to change any server configurations

Go to $HOME/.ssh/config and add

Host *
  GSSAPIAuthentication no

I have recently found another cause of slow ssh logins.

Even if you have "UseDNS no" in /etc/sshd_config, sshd may still perform reverse DNS lookups if /etc/hosts.deny has an entry like nnn-nnn-nnn-nnn.rev.some.domain.com. That might happen if you have Denyhosts installed in your system.

It would be great if someone knew how to make Denyhosts avoid putting this kind of entry in /etc/hosts.deny.

Here is a link to the Denyhosts FAQ on how to remove entries from /etc/hosts.deny

Just add IP address with hostname in /etc/host , It'll short out your problem :)

  • That does not seem like the correct answer at all. Plus, it's /etc/hosts, not /etc/host. – Celada Feb 17 '15 at 12:08

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.