28

I just installed Ubuntu 11.10, and whenever I try to SSH into my servers it's very slow. Before it displays the password prompt, it can take between 40 seconds and 60 seconds.

I use:

ssh [email protected]

Once I'm logged in, everything is fine and it works fast.

Why does it take so long, and how can i fix it? Are there any options in the SSH command I can use?

0

2 Answers 2

45

This is slow because the OpenSSH daemon uses DNS to run a reverse lookup on the client hostname to make sure it's valid

sudo vi /etc/ssh/ssh_config

Comment out the following lines

#GSSAPIAuthentication yes
#GSSAPIDelegateCredentials no

OR

add this:

UseDNS no
8
  • 6
    There is an sshd_config file for the server side and ssh_config for the client side. Setting these options on the client and the server in the ssh_config file didn't help me. Only after I set GSSAPIAuthentication no and GSSAPIDelegateCredentials yes and added UseDNS no in the server's sshd_config file did it speed the connection up for me.
    – metakermit
    May 5, 2014 at 8:02
  • 1
    Is there no security implication of doing this? Apr 12, 2016 at 10:19
  • @TheStoryCoder good question, ill have to double check, you triggered my curiosity now... Apr 13, 2016 at 2:47
  • 1
    After added UseDNS no, I got Bad configuration option: usedns when I tried to ssh login another server.
    – Casper
    Feb 28, 2017 at 19:55
  • 2
    Try setting UseDNS to no in /etc/sshd_config or /etc/ssh/sshd_config. NOT /etc/ssh_config!
    – Yu Jiaao
    Jul 25, 2018 at 8:22
14

This is just a complement of the answer of Book Of Zeus. In case you don't have root access (sudo), you can still configure it.

You need to edit your "user ssh_config" file which is:

vi $HOME/.ssh/config

(Note: you would have to create the directory $HOME/.ssh if it does not exist)

And add:

Host *
  GSSAPIAuthentication no
  GSSAPIDelegateCredentials yes

You can do so on a per host basis if required :) example:

Host linux-srv
  HostName 192.158.1.1
  GSSAPIAuthentication no
  GSSAPIDelegateCredentials yes

Make sure the IP address match your server IP. One cool advantage is that now ssh will provide autocomplete for this server. So you can type ssh lin + Tab and it should autocomplete to ssh linux-srv.

You can add a bunch of usefull options so that you don't have to type them each time:

User <a user>
Port <a port number>
IdentityFile <a specific private key>
Compression yes
....

So instead of typing ssh -C -p 1022 -i ~/.hidden/prv-key-4096bit [email protected] a simple ssh linux-srv would suffice!

Not the answer you're looking for? Browse other questions tagged .