Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Linux system running Redhat 5.1.

When I connect to the machines with SSH there is a long delay before the login completes and I get a shell.

I did some research and found a solution to this problem that suggested that I could remove the /etc/resolv.conf, and then logins would work quickly. I tried doing this and it actually worked; removing the /etc/resolv.conf sped things up.

So now I want to understand why this is causing a problem, and how to get fast SSH logins without breaking name resolution.

Update: UseDNS no was in sshd_config (but has not fixed the issue)

share|improve this question
    
How long is "long" - seconds, minutes? If you login, logout, and login again, is the login any faster the second time? –  Andrew Mar 21 '12 at 2:25

3 Answers 3

up vote 4 down vote accepted

As a security measure when you connect to ssh server, the server will perform several DNS lookups on the IP address you are connecting from. These DNS checks make take a while, particularly if the reverse zones are not setup properly for the IP addresses you are connecting from.

In your /etc/ssh/sshd_config there is an option you can set to disable DNS checks. Specifically you would want to set UseDNS no.

man sshd_config

UseDNS

Specifies whether sshd(8) should look up the remote host name and check that the resolved host name for the remote IP address maps back to the very same IP address. The default is ''yes''.

Another common source of problems can be related to tcpwrappers. If SSH is compiled to use tcpwrappers, and tcpwrappers is compiled to do DNS lookups, then you can see slowness from this.

If you are connecting from within your network, the majority of the delay will be fixed by setting up proper reverse DNS zones.

share|improve this answer
    
yes but UseDNS no. was in the sshd_config so only after I removed the resolv.conf its fix that –  Eytan Mar 20 '12 at 19:13

It probably has as much to do with the /etc/nsswitch.conf file as it does the /etc/resolv.conf file. nsswitch.conf tells linux the order in which it should use different methods (dns, nis, /etc/hosts, etc) to resolve things like hosts, services, networks, etc.

resolv.conf is specifically for dns lookups, and my guess is that /etc/nsswitch.conf says to use dns before using files when looking up hosts and when /etc/resolv.conf does not exist, it skips doing a DNS lookup. So when you were typing ssh username@hostname it used to try to do a dns lookup before falling back to some other means, but now it just skips that step.

There may be other things going on, but it's probably related/similar.

Take care.

share|improve this answer
    
did you check nsswitch.conf? –  gymbrall Mar 21 '12 at 1:37

Add the following line to your sshd_config file:

UseDNS no

That will do the trick!

share|improve this answer
    
yes but UseDNS no. was in the sshd_config so only after I removed the resolv.conf its fix that –  Eytan Mar 20 '12 at 19:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.