Re: WRT FAQ: slow logins
"Karsten M. Self" <[email protected]>
| Newsgroups | gmane.os.openbsd.www |
|---|---|
| Message-ID | <[email protected]> |
Janne: thanks for your response. on Wed, Nov 24, 2010 at 09:08:27AM +0100, Janne Johansson ([email protected]) wrote: > 2010/11/11 Karsten M. Self <[email protected]> > > > FAQ 3.3: ssh(1) takes a long time to connect or log in. > > > > I've also seen this happen due to either kerberos being enabled, or > > GSSAPI being used. > > > > I forget the solution to the kerberos problem, though IIRC it involved > > removing kerberised SSH from the shell search PATH. > > > > In the case of GSSAPI: > > > > GSSAPIAuthentication no > > > > (at the command line, in ~/.ssh/config, or /etc/ssh/ssh_config) resolves > > the issue. With the option enabled, I see a ~30s delay in connections, > > visible at two points in the process with 'ssh -v <hostname>' > > > > > This feels all weird to me. First of all, openssh doesnt ship with > GSSAPIAuthentication enabled by default, I don't recall if this was enabled by default or if I'd enabled it for some specific reason (I don't recall that I did). And there's enough wonkiness going on with our DNS at work that reverse lookups are a pretty likely suspect. That said: disabling GSSAPIAuthentication at the command line or in user or host configs fixes the problem. Pretty convincingly, and for multiple users. > secondly if you actually use krb5 and enable GSSAPI it does not in itself > cause any 30 second timeouts > unless you have something broken, like reverse DNS mappings, which still > makes the FAQ suggestion apply. > > If your site needs/uses GSSAPI, then removing "kerberized ssh from the > $PATH" or taking out GSSAPI from the > local ssh_config is definately not the correct solution and only hides the > symptoms of a broken site. The site doesn't use/need GSSAPI. Disabling the option results in no functionality loss and far faster session set-up. Any suggestions on further isolating DNS as the culprit? Peace. > -- > To our sweethearts and wives. May they never meet. -- 19th century toast I love that saying. It's an old sailor's toast, as I recall. We use it frequently at the rowing club ;-) -- Karsten M. Self <[email protected]> http://linuxmafia.com/~karsten What part of "gestalt" don't you understand? [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]