Re: WRT FAQ: slow logins

2010/11/11 Karsten M. Self <[email protected]>

> FAQ 3.3: ssh(1) takes a long time to connect or log in.
>
> I've also seen this happen due to either kerberos being enabled, or
> GSSAPI being used.
>
> I forget the solution to the kerberos problem, though IIRC it involved
> removing kerberised SSH from the shell search PATH.
>
> In the case of GSSAPI:
>
>    GSSAPIAuthentication no
>
> (at the command line, in ~/.ssh/config, or /etc/ssh/ssh_config) resolves
> the issue.  With the option enabled, I see a ~30s delay in connections,
> visible at two points in the process with 'ssh -v <hostname>'
>
>
This feels all weird to me. First of all, openssh doesnt ship with
GSSAPIAuthentication enabled by default,
secondly if you actually use krb5 and enable GSSAPI it does not in itself
cause any 30 second timeouts
unless you have something broken, like reverse DNS mappings, which still
makes the FAQ suggestion apply.

If your site needs/uses GSSAPI, then removing "kerberized ssh from the
$PATH" or taking out GSSAPI from the
local ssh_config is definately not the correct solution and only hides the
symptoms of a broken site.

-- 
 To our sweethearts and wives.  May they never meet. -- 19th century toast