ssh 連接很慢的解決辦法
=============
現象：
在局域網內，能ping通目標機器，並且時延是微秒級。
用ssh連局域網內其他linux機器，會等待10-30秒纔有提示輸入密碼。嚴重影響工作效率。
========================
客戶端操作系統版本：
zhouhh@zhhofs:~$ cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=9.10
DISTRIB_CODENAME=karmic
DISTRIB_DESCRIPTION="Ubuntu 9.10"
========================
調試信息：
[css] view plain copy zhouhh@zhhofs:~$ ssh -v 192.168.12.16 OpenSSH_5.1p1 Debian-6ubuntu2, OpenSSL 0.9.8g 19 Oct 2007 debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Connecting to 192.168.12.16 [192.168.12.16] port 22. debug1: Connection established. debug1: identity file /home/zhouhh/.ssh/identity type -1 debug1: identity file /home/zhouhh/.ssh/id_rsa type -1 debug1: identity file /home/zhouhh/.ssh/id_dsa type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_4.3 debug1: match: OpenSSH_4.3 pat OpenSSH_4* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_5.1p1 Debian-6ubuntu2 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-cbc hmac-md5 none debug1: kex: client->server aes128-cbc hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug1: Host '192.168.12.16' is known and matches the RSA host key. debug1: Found key in /home/zhouhh/.ssh/known_hosts:1 debug1: ssh_rsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,gssapi-with-mic,password debug1: Next authentication method: gssapi-with-mic deb ug1: An invalid name was supplied Cannot determine realm for numeric host address debug1: An invalid name was supplied Cannot determine realm for numeric host address debug1: An invalid name was supplied debug1: Next authentication method: publickey debug1: Trying private key: /home/zhouhh/.ssh/identity debug1: Trying private key: /home/zhouhh/.ssh/id_rsa debug1: Trying private key: /home/zhouhh/.ssh/id_dsa debug1: Next authentication method: password [email protected]'s password: debug1: Authentication succeeded (password). debug1: channel 0: new [client-session] debug1: Entering interactive session. debug1: Sending environment. debug1: Sending env LANG = zh_CN.UTF-8 Last login: Fri Dec 25 13:35:04 2009 from 192.168.11.146
可以看到如下的錯誤信息：
debug1: Next authentication method: gssapi-with-mic
debug1: An invalid name was supplied
Cannot determine realm for numeric host address
事實上，正是從gssapi-with-mic這一行開始，開始耗時間。
====================
失敗的嘗試：
有人說是在目標機器中修改/etc/ssh/sshd_conf文件
將UseDNS 的缺省值由yes修改爲no，並重啓sshd。我試了，對這種情況不管用。但不排除對別的延遲情況管用。
====================
有效的解決辦法：
1. 修改本地機器的hosts文件，將目標機器的IP和域名加上去。或者讓本機的DNS 服務器能解析目標地址。
vi /etc/hosts
192.168.12.16 ourdev
其格式是“目標機器IP 目標機器名稱”這種方法促效。沒有延遲就連上了。不過如果給每臺都加一個域名解析，挺辛苦的。但在windows下用putty或secure-crt時可以採用這種方法。
2.修改本機的客戶端配置文件ssh_conf，注意，不是sshd_conf
vi /etc/ssh/ssh_conf
找到
GSSAPIAuthentication yes
改爲
GSSAPIAuthentication no
保存。
再連目標機器，速度就飛快了。
GSSAPI ( Generic Security Services Application Programming Interface) 是一套類似Kerberos 5 的通用網絡安全系統接口。該接口是對各種不同的客戶端服務器安全機制的封裝，以消除安全接口的不同，降低編程難度。但該接口在目標機器無域名解析時會有問題。我看到有人給ubuntu提交了相關bug， 說要將GSSAPIAuthentication的缺省值設爲no，不知爲何，ubuntu9.10的缺省值還是yes。
修改完畢，此時的連接調試數據變爲了：
zhouhh@zhhofs:~$ ssh -v 192.168.12.16 OpenSSH_5.1p1 Debian-6ubuntu2, OpenSSL 0.9.8g 19 Oct 2007 debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Connecting to 192.168.12.16 [192.168.12.16] port 22. debug1: Connection established. debug1: identity file /home/zhouhh/.ssh/identity type -1 debug1: identity file /home/zhouhh/.ssh/id_rsa type -1 debug1: identity file /home/zhouhh/.ssh/id_dsa type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_4.3 debug1: match: OpenSSH_4.3 pat OpenSSH_4* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_5.1p1 Debian-6ubuntu2 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-cbc hmac-md5 none debug1: kex: client->server aes128-cbc hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug1: Host '192.168.12.16' is known and matches the RSA host key. debug1: Found key in /home/zhouhh/.ssh/known_hosts:1 debug1: ssh_rsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,gssapi-with-mic,password debug1: Next authentication method: publickey debug1: Trying private key: /home/zhouhh/.ssh/identity debug1: Trying private key: /home/zhouhh/.ssh/id_rsa debug1: Trying private key: /home/zhouhh/.ssh/id_dsa debug1: Next authentication method: password [email protected]'s password:
版權聲明：本文爲博主原創文章，未經博主允許不得轉載。（轉載該博主）
周海漢 /文
頂
1
踩