Linux SSH登錄很慢的解決方法
發(fā)布時間：2015-06-16 15:55:37 作者：佚名 
我要評論
我要評論這篇文章主要介紹了Linux SSH登錄很慢的解決方法,本文介紹了兩種解決方法,分別是DNS反向解析問題、關(guān)閉ssh的gssapi認(rèn)證,需要的朋友可以參考下
使用ssh客戶端（如：putty）連接Linux服務(wù)器，可能會等待10-30秒才有提示輸入密碼。嚴(yán)重影響工作效率。登錄很慢，登錄上去后速度正常，這種情況主要有兩種可能的原因：
1. DNS反向解析問題
OpenSSH在用戶登錄的時候會驗證IP，它根據(jù)用戶的IP使用反向DNS找到主機(jī)名，再使用DNS找到IP地址，最后匹配一下登錄的IP是否合法。如果客戶機(jī)的IP沒有域名，或者DNS服務(wù)器很慢或不通，那么登錄就會很花時間。
解決辦法：
在目標(biāo)服務(wù)器上修改sshd服務(wù)器端配置,并重啟sshd
復(fù)制代碼
代碼如下:vi /etc/ssh/sshd_config
UseDNS no
2. 關(guān)閉ssh的gssapi認(rèn)證
用ssh -v user@server 可以看到登錄時有如下信息：
復(fù)制代碼
代碼如下:debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure. Minor code may provide more information
注：ssh -vvv user@server 可以看到更細(xì)的debug信息
解決辦法：
修改sshd服務(wù)器端配置
復(fù)制代碼
代碼如下:vi /etc/ssh/ssh_config
GSSAPIAuthentication no
可以使用ssh -o GSSAPIAuthentication=no user@server登錄
GSSAPI ( Generic Security Services Application Programming Interface) 是一套類似Kerberos 5的通用網(wǎng)絡(luò)安全系統(tǒng)接口。該接口是對各種不同的客戶端服務(wù)器安全機(jī)制的封裝，以消除安全接口的不同，降低編程難度。但該接口在目標(biāo)機(jī)器無域名解析時會有問題
使用strace查看后發(fā)現(xiàn)，ssh在驗證完key之后，進(jìn)行authentication gssapi-with-mic，此時先去連接DNS服務(wù)器，在這之后會進(jìn)行其他操作
復(fù)制代碼
代碼如下:[root@192-168-3-40 ~]# ssh -vvv root@192.168.3.44
OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 192.168.3.44 [192.168.3.44] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/identity type -1
debug1: identity file /root/.ssh/identity-cert type -1
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug3: Wrote 960 bytes for a total of 981
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: found hmac-md5
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug3: Wrote 24 bytes for a total of 1005
debug2: dh_gen_key: priv key bits set: 120/256
debug2: bits set: 506/1024
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug3: Wrote 144 bytes for a total of 1149
debug3: check_host_in_hostfile: host 192.168.3.44 filename /root/.ssh/known_hosts
debug3: check_host_in_hostfile: host 192.168.3.44 filename /root/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 8
debug1: Host '192.168.3.44' is known and matches the RSA host key.
debug1: Found key in /root/.ssh/known_hosts:8
debug2: bits set: 527/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: Wrote 16 bytes for a total of 1165
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug3: Wrote 48 bytes for a total of 1213
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /root/.ssh/identity ((nil))
debug2: key: /root/.ssh/id_rsa ((nil))
debug2: key: /root/.ssh/id_dsa ((nil))
debug2: key: /root/.ssh/id_ecdsa ((nil))
debug3: Wrote 64 bytes for a total of 1277
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup gssapi-keyex
debug3: remaining preferred: gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_is_enabled gssapi-keyex
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug2: we did not send a packet, disable method
debug3: authmethod_lookup gssapi-with-mic
debug3: remaining preferred: publickey,keyboard-interactive,password
debug3: authmethod_is_enabled gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug3: Trying to reverse map address 192.168.3.44.
debug1: Unspecified GSS failure. Minor code may provide more information
Cannot determine realm for numeric host address</p> <p>debug1: Unspecified GSS failure. Minor code may provide more information
Cannot determine realm for numeric host address</p> <p>debug1: Unspecified GSS failure. Minor code may provide more information</p> <p>
debug1: Unspecified GSS failure. Minor code may provide more information
Cannot determine realm for numeric host address</p> <p>debug2: we did not send a packet, disable method
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/identity
debug3: no such identity: /root/.ssh/identity
debug1: Trying private key: /root/.ssh/id_rsa
debug3: no such identity: /root/.ssh/id_rsa
debug1: Trying private key: /root/.ssh/id_dsa
debug3: no such identity: /root/.ssh/id_dsa
debug1: Trying private key: /root/.ssh/id_ecdsa
debug3: no such identity: /root/.ssh/id_ecdsa
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password
root@192.168.3.44's password:
相關(guān)文章
Fedora Linux 42 穩(wěn)定版發(fā)布: 帶來大量新功能和軟件更新
Fedora 42昨日發(fā)布，這是 Red Hat 贊助開發(fā)的杰出前沿 Linux 發(fā)行版的最新版，包含大量新功能和軟件更新，使其成為 2025 年上半年發(fā)布的一款出色的 Linux 操作系統(tǒng)之一，內(nèi)2025-04-16
如何在Linux查看硬盤信息? 查看Linux硬盤大小類型和硬件信息的5種方法
使用Linux系統(tǒng)的過程中，查看和了解硬盤信息是非常重要的工作，尤其是對于系統(tǒng)管理員而言，那么在Linux系統(tǒng)中如何查看硬盤信息?以下是具體內(nèi)容介紹2025-03-12如何在 Linux 中查看 CPU 詳細(xì)信息? 3招輕松查看CPU型號、核心數(shù)和溫度
在日常運維工作中，獲取 CPU 信息是系統(tǒng)運維管理員常見的工作內(nèi)容，無論是為了性能調(diào)優(yōu)、硬件升級還是僅僅滿足好奇心2025-03-11
什么是 Arch Linux? 獨樹一幟的Arch Linux發(fā)行版分析
Arch Linux是為簡化，優(yōu)化，現(xiàn)代化，實用主義，用戶中心和多功能性而創(chuàng)建Linux發(fā)行版，究竟是什么讓 Arch 與眾不同？下面我們就來簡要解讀2025-02-19如何在Linux環(huán)境下制作 Win11裝機(jī)U盤?
一直用的linux辦公，想要將筆記本電腦從 Linux 系統(tǒng)切換回 Windows 11，我們可以制作一個win11裝機(jī)u盤，詳細(xì)如下2025-02-17Rsnapshot怎么用? 基于Rsync的強(qiáng)大Linux備份工具使用指南
Rsnapshot 不僅可以備份本地文件，還能通過 SSH 備份遠(yuǎn)程文件，接下來詳細(xì)介紹如何安裝、配置和使用 Rsnapshot，包括創(chuàng)建每小時、每天、每周和每月的本地備份，以及如何進(jìn)2025-02-06
Linux Kernel 6.13發(fā)布:附更新內(nèi)容及新特性解讀
Linux 內(nèi)核 6.13 正式發(fā)布，新版本引入了惰性搶占支持，簡化內(nèi)核搶占邏輯，通過減少與調(diào)度器相關(guān)的調(diào)用次數(shù)，讓內(nèi)核在運行時表現(xiàn)更優(yōu)，從而提高效率2025-01-23
五大特性引領(lǐng)創(chuàng)新! 深度操作系統(tǒng) deepin 25 Preview預(yù)覽版發(fā)布
今日，深度操作系統(tǒng)正式推出deepin 25 Preview版本，該版本集成了五大核心特性：磐石系統(tǒng)、全新DDE、Treeland窗口合成器、AI For OS以及Distrobox子系統(tǒng)2025-01-18
Linux Mint Xia 22.1重磅發(fā)布: 重要更新一覽
Beta 版 Linux Mint“Xia” 22.1 發(fā)布，新版本基于 Ubuntu 24.04，內(nèi)核版本為 Linux 6.8，這次更新帶來了諸多優(yōu)化和改進(jìn)，進(jìn)一步鞏固了 Mint 在 Linux 桌面操作系統(tǒng)領(lǐng)域的2025-01-16
LinuxMint怎么安裝? Linux Mint22下載安裝圖文教程
Linux Mint22發(fā)布以后，有很多新功能，很多朋友想要下載并安裝，該怎么操作呢？下面我們就來看看詳細(xì)安裝指南2025-01-16
