快捷導(dǎo)航

ssh 登錄很慢該如何解決

更新時(shí)間：2017年01月04日 08:57:00 投稿：lqh

這篇文章主要介紹了ssh 登錄很慢該如何解決的相關(guān)資料,這里提供了兩種方法，DNS反向解析及關(guān)閉ssh的gssapi認(rèn)證的解決辦法，需要的朋友可以參考下

ssh登錄很慢解決方法

使用ssh客戶端（如：putty）連接Linux服務(wù)器，可能會等待10-30秒才有提示輸入密碼。嚴(yán)重影響工作效率。登錄很慢，登錄上去后速度正常，這種情況主要有兩種可能的原因：

1. DNS反向解析問題

OpenSSH在用戶登錄的時(shí)候會驗(yàn)證IP，它根據(jù)用戶的IP使用反向DNS找到主機(jī)名，再使用DNS找到IP地址，最后匹配一下登錄的IP是否合法。如果客戶機(jī)的IP沒有域名，或者DNS服務(wù)器很慢或不通，那么登錄就會很花時(shí)間。

解決辦法：在目標(biāo)服務(wù)器上修改sshd服務(wù)器端配置,并重啟sshd

vi /etc/ssh/sshd_config
UseDNS no

2. 關(guān)閉ssh的gssapi認(rèn)證

用ssh -v user@server 可以看到登錄時(shí)有如下信息：

debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure. Minor code may provide more information

注：ssh -vvv user@server 可以看到更細(xì)的debug信息

解決辦法：

修改sshd服務(wù)器端配置

vi /etc/ssh/ssh_config
GSSAPIAuthentication no

可以使用ssh -o GSSAPIAuthentication=no user@server登錄

GSSAPI ( Generic Security Services Application Programming Interface) 是一套類似Kerberos 5的通用網(wǎng)絡(luò)安全系統(tǒng)接口。該接口是對各種不同的客戶端服務(wù)器安全機(jī)制的封裝，以消除安全接口的不同，降低編程難度。但該接口在目標(biāo)機(jī)器無域名解析時(shí)會有問題

使用strace查看后發(fā)現(xiàn)，ssh在驗(yàn)證完key之后，進(jìn)行authentication gssapi-with-mic，此時(shí)先去連接DNS服務(wù)器，在這之后會進(jìn)行其他操作

[root@192-168-3-40 ~]# ssh -vvv root@192.168.3.44 
OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013 
debug1: Reading configuration data /etc/ssh/ssh_config 
debug1: Applying options for * 
debug2: ssh_connect: needpriv 0 
debug1: Connecting to 192.168.3.44 [192.168.3.44] port 22. 
debug1: Connection established. 
debug1: permanently_set_uid: 0/0 
debug1: identity file /root/.ssh/identity type -1 
debug1: identity file /root/.ssh/identity-cert type -1 
debug1: identity file /root/.ssh/id_rsa type -1 
debug1: identity file /root/.ssh/id_rsa-cert type -1 
debug1: identity file /root/.ssh/id_dsa type -1 
debug1: identity file /root/.ssh/id_dsa-cert type -1 
debug1: identity file /root/.ssh/id_ecdsa type -1 
debug1: identity file /root/.ssh/id_ecdsa-cert type -1 
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3 
debug1: match: OpenSSH_5.3 pat OpenSSH* 
debug1: Enabling compatibility mode for protocol 2.0 
debug1: Local version string SSH-2.0-OpenSSH_5.3 
debug2: fd 3 setting O_NONBLOCK 
debug1: SSH2_MSG_KEXINIT sent 
debug3: Wrote 960 bytes for a total of 981 
debug1: SSH2_MSG_KEXINIT received 
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 
debug2: kex_parse_kexinit: ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-rsa,ssh-dss 
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se 
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se 
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib 
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss 
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se 
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se 
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 
debug2: kex_parse_kexinit: none,zlib@openssh.com 
debug2: kex_parse_kexinit: none,zlib@openssh.com 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: mac_setup: found hmac-md5 
debug1: kex: server->client aes128-ctr hmac-md5 none 
debug2: mac_setup: found hmac-md5 
debug1: kex: client->server aes128-ctr hmac-md5 none 
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent 
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP 
debug3: Wrote 24 bytes for a total of 1005 
debug2: dh_gen_key: priv key bits set: 120/256 
debug2: bits set: 506/1024 
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent 
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY 
debug3: Wrote 144 bytes for a total of 1149 
debug3: check_host_in_hostfile: host 192.168.3.44 filename /root/.ssh/known_hosts 
debug3: check_host_in_hostfile: host 192.168.3.44 filename /root/.ssh/known_hosts 
debug3: check_host_in_hostfile: match line 8 
debug1: Host '192.168.3.44' is known and matches the RSA host key. 
debug1: Found key in /root/.ssh/known_hosts:8 
debug2: bits set: 527/1024 
debug1: ssh_rsa_verify: signature correct 
debug2: kex_derive_keys 
debug2: set_newkeys: mode 1 
debug1: SSH2_MSG_NEWKEYS sent 
debug1: expecting SSH2_MSG_NEWKEYS 
debug3: Wrote 16 bytes for a total of 1165 
debug2: set_newkeys: mode 0 
debug1: SSH2_MSG_NEWKEYS received 
debug1: SSH2_MSG_SERVICE_REQUEST sent 
debug3: Wrote 48 bytes for a total of 1213 
debug2: service_accept: ssh-userauth 
debug1: SSH2_MSG_SERVICE_ACCEPT received 
debug2: key: /root/.ssh/identity ((nil)) 
debug2: key: /root/.ssh/id_rsa ((nil)) 
debug2: key: /root/.ssh/id_dsa ((nil)) 
debug2: key: /root/.ssh/id_ecdsa ((nil)) 
debug3: Wrote 64 bytes for a total of 1277 
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password 
debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password 
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password 
debug3: authmethod_lookup gssapi-keyex 
debug3: remaining preferred: gssapi-with-mic,publickey,keyboard-interactive,password 
debug3: authmethod_is_enabled gssapi-keyex 
debug1: Next authentication method: gssapi-keyex 
debug1: No valid Key exchange context 
debug2: we did not send a packet, disable method 
debug3: authmethod_lookup gssapi-with-mic 
debug3: remaining preferred: publickey,keyboard-interactive,password 
debug3: authmethod_is_enabled gssapi-with-mic 
debug1: Next authentication method: gssapi-with-mic 
debug3: Trying to reverse map address 192.168.3.44. 
debug1: Unspecified GSS failure. Minor code may provide more information 
Cannot determine realm for numeric host address 
 
debug1: Unspecified GSS failure. Minor code may provide more information 
Cannot determine realm for numeric host address 
 
debug1: Unspecified GSS failure. Minor code may provide more information 
 
 
debug1: Unspecified GSS failure. Minor code may provide more information 
Cannot determine realm for numeric host address 
 
debug2: we did not send a packet, disable method 
debug3: authmethod_lookup publickey 
debug3: remaining preferred: keyboard-interactive,password 
debug3: authmethod_is_enabled publickey 
debug1: Next authentication method: publickey 
debug1: Trying private key: /root/.ssh/identity 
debug3: no such identity: /root/.ssh/identity 
debug1: Trying private key: /root/.ssh/id_rsa 
debug3: no such identity: /root/.ssh/id_rsa 
debug1: Trying private key: /root/.ssh/id_dsa 
debug3: no such identity: /root/.ssh/id_dsa 
debug1: Trying private key: /root/.ssh/id_ecdsa 
debug3: no such identity: /root/.ssh/id_ecdsa 
debug2: we did not send a packet, disable method 
debug3: authmethod_lookup password 
debug3: remaining preferred: ,password 
debug3: authmethod_is_enabled password 
debug1: Next authentication method: password 
root@192.168.3.44's password:

感謝閱讀，希望能幫助到大家，謝謝大家對本站的支持！

您可能感興趣的文章: