wikiSlow SSH login due to DNS timeout
This article describes solutions for when an SSH login is slow.
Problem
It takes approximately 10 seconds when you log in to a Linux system via SSH until the password prompt appears. After this, the SSH session functions completely normal.
Background
The SSH server tries to make a reverse DNS lookup for the IP from which the SSH connection is established. If there is no functioning configured DNS (for example a wrong registered IP for the DNS server in /etc/resolv.conf), it takes 10 seconds until the timeout is reached for the reverse DNS lookup. Then, the password prompt appears.
In the following, information on the use of ssh -v (verbose mode) is listed:
[admin@tpw admin]$ ssh -v root@192.168.1.154 OpenSSH_5.1p1, OpenSSL 0.9.8g 19 Oct 2007 debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Connecting to 192.168.1.154 [192.168.1.154] port 22. debug1: Connection established. debug1: identity file /home/admin/.ssh/identity type -1 debug1: identity file /home/admin/.ssh/id_rsa type -1 debug1: identity file /home/admin/.ssh/id_dsa type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_5.1p1 Debian-5 debug1: match: OpenSSH_5.1p1 Debian-5 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_5.1 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-cbc hmac-md5 none debug1: kex: client->server aes128-cbc hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug1: Host '192.168.1.154' is known and matches the RSA host key. debug1: Found key in /home/admin/.ssh/known_hosts:153 debug1: ssh_rsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received
Now, it takes ten minutes until it continues:
debug1: Authentications that can continue: publickey,password debug1: Next authentication method: publickey debug1: Trying private key: /home/admin/.ssh/identity debug1: Trying private key: /home/admin/.ssh/id_rsa debug1: Trying private key: /home/admin/.ssh/id_dsa debug1: Next authentication method: password root@192.168.1.154's password:
After entering the password, it continues:
debug1: Authentication succeeded (password). debug1: channel 0: new [client-session] debug1: Requesting no-more-sessions@openssh.com debug1: Entering interactive session. debug1: Sending environment. debug1: Sending env LANG = en_US.utf8 Linux debian5 2.6.9-023stab048.6-smp #1 SMP Mon Nov 17 18:41:14 MSK 2008 x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Wed Jun 17 13:20:19 2009 from 192.168.1.52 debian5:~#
Solution
On the target system, either add the IP address of the computer from which the connection is being established to /etc/hosts, or make sure that the DNS configuration on the target system is working properly.
Enter IP in /etc/hosts
The IP can be, for example, entered in /etc/hosts as follows:
root@debian5:/# echo "192.168.1.52 laptop" >> /etc/hosts root@debian5:/# cat /etc/hosts 127.0.0.1 debian5 localhost localhost.localdomain ::1 localhost ip6-localhost ip6-loopback fe00::0 ip6-localnet ff00::0 ip6-mcastprefix ff02::1 ip6-allnodes ff02::2 ip6-allrouters ff02::3 ip6-allhosts 192.168.1.52 laptop root@debian5:/#
Verify DNS configuration
In the example, an incorrect DNS server was configured on the Debian 5 target system. The configuration was corected as follows:
root@debian5:/# cat /etc/resolv.conf nameserver 10.10.18.1 root@debian5:/# echo "nameserver 192.168.1.254" > /etc/resolv.conf root@debian5:/# cat /etc/resolv.conf nameserver 192.168.1.254 root@debian5:/#
More information
 |
Author: Werner Fischer Werner Fischer, working in the Knowledge Transfer team at Thomas-Krenn, completed his studies of Computer and Media Security at FH Hagenberg in Austria. He is a regular speaker at many conferences like LinuxTag, OSMC, OSDC, LinuxCon, and author for various IT magazines. In his spare time he enjoys playing the piano and training for a good result at the annual Linz marathon relay.
|
 |
Translator: Alina Ranzinger Alina has been working at Thomas-Krenn.AG since 2024. After her training as multilingual business assistant, she got her job as assistant of the Product Management and is responsible for the translation of texts and for the organisation of the department.
|
