Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When connecting to a Debian server using ssh, if I use user@XXX.XXX.XXX.XXX (the IP address of the server) the connection is instant.

If however I use user@hostname.com (a DNS redirected to the IP address of the server) the ssh connection hangs for a 20 seconds before connecting successfully. The ssh logs show the following:

[alex@alex home]$ ssh -v -v git@hotname.com
OpenSSH_5.5p1, OpenSSL 1.0.0c-fips 2 Dec 2010
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0

and here it hangs during 20 seconds before continuing.

I think it might have something to do with reverse DNS or similar (the server does not really "know" it's name is hostname.com, it just has that DNS rediriected to its IP address).

I have added the following options to /etc/ssh/sshd_config:

UseDNS no
GSSAPIAuthentication no

to no effect.

The server's DNS records in /etc/resolv.conf are configured correctly:

ping hostname.com
PING sub.domain.com (X.X.X.X) 56(84) bytes of data.
64 bytes from replicant (X.X.X.X): icmp_seq=1 ttl=64 time=0.029 ms
64 bytes from replicant (X.X.X.X): icmp_seq=2 ttl=64 time=0.050 ms�s

Thanks for the help.

Solution: It seems the DSL router my ISP saddled me with was causing the trouble.

Changing my DNS server from 192.168.1.1 (router's IP) to google's (8.8.8.8, always good to know when you are in a hurry) instantly solved the connection delay problem.

I am guessing that the 50€ router provided does not cache DNS entries, although I don't understand why pinging the DNS address had no delay, and 20 seconds is too long of a wait, even for uncached DNS.

Tnanks again for the help!

share|improve this question
    
Have you tried doing a packet capture on the server while a new connection is being made? What is happending during that 20 second slow window? –  Zoredache Dec 15 '10 at 19:32
add comment

3 Answers

up vote 3 down vote accepted

You'll need to add

GSSAPIAuthentication no

...to /etc/ssh/ssh_config, not /etc/ssh/sshd_config as you've said. To check if that's definitely the fix, try adding -o GSSAPIAuthentication=no to your commandline to see if that changes things.

share|improve this answer
add comment

You may have some DNS problems on the client side, check how much time it needs to resolve your server's hostname:

[vitalie@silver ~]$ time host www.google.com
www.google.com is an alias for www.l.google.com.
www.l.google.com has address 74.125.87.99
www.l.google.com has address 74.125.87.104

real    0m0.727s
user    0m0.002s
sys     0m0.008s
share|improve this answer
add comment

I am using a Mac client. Disabling GSSAPIAuthentication on the server had no effect.

I followed http://hints.macworld.com/article.php?story=20111020115417965 and turned off IPv6 in my ~/.ssh/config by adding:

Host ...
AddressFamily inet

This solved the issue :-)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.