4

Linux system running Redhat 5.1.

When I connect to the machines with SSH there is a long delay before the login completes and I get a shell.

I did some research and found a solution to this problem that suggested that I could remove the /etc/resolv.conf, and then logins would work quickly. I tried doing this and it actually worked; removing the /etc/resolv.conf sped things up.

So now I want to understand why this is causing a problem, and how to get fast SSH logins without breaking name resolution.

Update: UseDNS no was in sshd_config (but has not fixed the issue)

2
  • How long is "long" - seconds, minutes? If you login, logout, and login again, is the login any faster the second time?
    – Andrew
    Mar 21, 2012 at 2:25
  • In my case, /etc/resolv.conf pointed to a long-obsolete DNS server.
    – RonJohn
    Jun 27, 2023 at 3:59

3 Answers 3

5

As a security measure when you connect to ssh server, the server will perform several DNS lookups on the IP address you are connecting from. These DNS checks make take a while, particularly if the reverse zones are not setup properly for the IP addresses you are connecting from.

In your /etc/ssh/sshd_config there is an option you can set to disable DNS checks. Specifically you would want to set UseDNS no.

man sshd_config

UseDNS

Specifies whether sshd(8) should look up the remote host name and check that the resolved host name for the remote IP address maps back to the very same IP address. The default is ''yes''.

Another common source of problems can be related to tcpwrappers. If SSH is compiled to use tcpwrappers, and tcpwrappers is compiled to do DNS lookups, then you can see slowness from this.

If you are connecting from within your network, the majority of the delay will be fixed by setting up proper reverse DNS zones.

1
  • yes but UseDNS no. was in the sshd_config so only after I removed the resolv.conf its fix that
    – Eytan
    Mar 20, 2012 at 19:13
1

It probably has as much to do with the /etc/nsswitch.conf file as it does the /etc/resolv.conf file. nsswitch.conf tells linux the order in which it should use different methods (dns, nis, /etc/hosts, etc) to resolve things like hosts, services, networks, etc.

resolv.conf is specifically for dns lookups, and my guess is that /etc/nsswitch.conf says to use dns before using files when looking up hosts and when /etc/resolv.conf does not exist, it skips doing a DNS lookup. So when you were typing ssh username@hostname it used to try to do a dns lookup before falling back to some other means, but now it just skips that step.

There may be other things going on, but it's probably related/similar.

Take care.

1
  • did you check nsswitch.conf?
    – gymbrall
    Mar 21, 2012 at 1:37
-1

Add the following line to your sshd_config file:

UseDNS no

That will do the trick!

1
  • yes but UseDNS no. was in the sshd_config so only after I removed the resolv.conf its fix that
    – Eytan
    Mar 20, 2012 at 19:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .