I am having this issue right now with 3 servers at least.

When attempting to connect to the server via ssh with a private key with a specific user, it shows the welcome banner, takes almost two minutes and then the connection is closed.

ssh -i id_rsa prhtgvpi@hostname
***Welcome Banner***
Connection closed by xxx.xxx.xxx.xxx

This does not happen when authenticating with password or to other users, with private key or password.

Executing ssh -vvv does not show anything useful either.

On the server side I tried running sshd in debug mode with the following command:

sshd -ddd -p 2222

which gave me something to look at, after the banner is shown on the client side, it pauses with the following message:

debug3: Running AuthorizedKeysCommand: "/usr/bin/sss_ssh_authorizedkeys prhtgvpi" as "nobody"

Which takes too long to finish.

I tried running the command separately, and it took almost 2 minutes to finish.

I think that is where the problem is, but I don't know what does that command do, nor why is taking so long, only for that specific user. Running the same command with other users runs fine.

Looking at some forums and similar questions I found that it has something to do with how sssd communicates with IPA to authenticate users, which I know we have running on our server.

Does anybody know what does this script do?

By the way running it with --debug (as some sources say, but is not documented on the man pages) does not show anything else.

Thanks in advance.


Not sure if this solves the problem in the long term (something must be causing it), but tried this and the access was restored:

sss_cache -E
systemctl restart sssd

This was done with information from this source

Any thoughts?

  • You probably have a DNS problem. Make sure DNS service is up and running. – Michael Hampton Aug 6 '18 at 22:16

I would search for misconfigured sssd daemon (official documentation for RHEL 5.7).

If you are not using RedHat IPAM or its credential storage, you can simply disable checking hostkeys on SSSD (and addition done by RedHat, not part of OpenSSH at all). Just make sure /etc/ssh/sshd_config has this line commented out:

# AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys

If you want or have to keep SSSD running, I would increase debug level in /etc/sssd/sssd.conf to try to gather more insight of the SSSD exchange and possible sources of delay.

Hope it helps!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.