57

I have noticed that some Linux Servers in Network takes long time to connect using ssh.

Situations:

There are two situations I have faced:

  1. On some servers some times it takes a long time to ask for password

  2. but on other servers When I insert the password it doesn't respond . And after some time say 20 0r 30 seconds it just say Connection Closed

Detail for 1 case:

debug1: Authentications that can continue: publickey,gssapi-with-mic,password
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
Cannot determine realm for numeric host address

debug1: Unspecified GSS failure.  Minor code may provide more information
Cannot determine realm for numeric host address

debug1: Unspecified GSS failure.  Minor code may provide more information


debug1: Unspecified GSS failure.  Minor code may provide more information
Cannot determine realm for numeric host address

debug2: we did not send a packet, disable method
debug1: Next authentication method: publickey
debug1: Trying private key: /home/umairmustafa/.ssh/id_rsa
debug1: Trying private key: /home/umairmustafa/.ssh/id_dsa
debug1: Trying private key: /home/umairmustafa/.ssh/id_ecdsa
debug2: we did not send a packet, disable method
debug1: Next authentication method: password
3
  • 2
    Please include the last few lines from running with ssh -vv when it's taking a long time to respond. Also, if you have access to the server logs, the entries from your connecting will probably be helpful as well. As the question stands, any answer can only really be guesswork.
    – user
    Commented Feb 17, 2013 at 12:05
  • Updated Question.
    – OmiPenguin
    Commented Feb 17, 2013 at 13:21
  • Much better now. I don't have an answer, but it's plenty more answerable with the additional information. +1.
    – user
    Commented Feb 17, 2013 at 14:00

5 Answers 5

53

I had this same problem just this morning...

Edit your /etc/ssh/sshd_config to set GSSAPIAuthentication no

6
  • yes, this worked good Commented Mar 15, 2014 at 5:12
  • 7
    I had to run /sbin/service sshd restart after the edit to get this to work Commented Jul 18, 2014 at 18:37
  • 1
    That worked for me (specifically, setting this on the client machine that I was trying to log in to, then restarting sshd on it). Commented Apr 10, 2016 at 17:34
  • 6
    Care to elaborate further? Why should we do this? Commented Oct 10, 2018 at 15:05
  • 2
    @TimothyPulliam - A few thoughts 1) OPENssh uses this API and the underlying kerberos 5 code to provide a alternative means of authentication other than ssh_keys and I suspect most users are just using ssh_keys 2) From Oracle Linux Finding V-22473 "Allowing GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, increasing the attack surface of the system. GSSAPI authentication must be disabled unless needed." so it sounds like it improves security 3) Users who can't edit /etc/ssh/sshd_config can put it in their ~/.ssh/config file
    – MikeV
    Commented Oct 31, 2018 at 23:53
28

Often this happened to me when DNS was not correctly configured, but SSH is trying to do a reverse lookup on every connect, so it might be waiting for some high timeouts. Try doing this in /etc/ssh/sshd_config:

UseDNS no

And then restart the SSH daemon. This will make it not use reverse lookups anymore.

7
  • 4
    That is just papering over a serious problem. Fix DNS.
    – vonbrand
    Commented Feb 17, 2013 at 13:19
  • 2
    Not necessarily, we just decided to not use DNS in our production environment.
    – replay
    Commented Feb 17, 2013 at 13:29
  • 1
    Great idea. Just manage /etc/hosts by hand on all your machines. Wellcome back to the good old days of the nascent Internet!
    – vonbrand
    Commented Feb 17, 2013 at 13:41
  • 3
    @vonbrand Sounds like FUD. What reasoning do you have that UseDNS no is bad?
    – phemmer
    Commented Aug 12, 2014 at 16:25
  • 2
    @Patrick The option itself isn't bad, but it shouldn't be used to hide, "paper" over a DNS problem (which would probably be more important). Commented Oct 28, 2014 at 17:51
7

If you do not want to change any server configurations

Go to $HOME/.ssh/config and add

Host *
  GSSAPIAuthentication no
5

I found another reason that was causing ssh to take a minute or two to connect. If you make your connection as follows:

ssh -i keypair.pem [email protected]

and hostname.domain.com has both an IPv4 and Ipv6 address, it stalls out trying to connect over IPv6 first, then finally falls back to IPv4.

Simple fix, force it to use IPv4 only.

ssh -4 -i keypair.pem [email protected]

Or connect by IP address directly

ssh -i keypair.pem [email protected]
1
  • Thanks @selbie. If this is the case you can then add AddressFamily inet to your ~/.ssh/config for this host.
    – Cyrille
    Commented Nov 6, 2020 at 9:34
2

I have recently found another cause of slow ssh logins.

Even if you have "UseDNS no" in /etc/sshd_config, sshd may still perform reverse DNS lookups if /etc/hosts.deny has an entry like nnn-nnn-nnn-nnn.rev.some.domain.com. That might happen if you have Denyhosts installed in your system.

It would be great if someone knew how to make Denyhosts avoid putting this kind of entry in /etc/hosts.deny.

Here is a link to the Denyhosts FAQ on how to remove entries from /etc/hosts.deny

Not the answer you're looking for? Browse other questions tagged .