Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!

10.7: Removing a Delay in SSH commands to some hosts UNIX
Using SSH to connect to some servers can introduce long delays from the time the command is issued until the connection with the server is established. This hint describes two potential problems and offers a solution.

In connecting to a local server, my ssh command would take about 20 seconds to complete. Non-Macintosh clients would not see this delay. After searching for the web and slogging through a number of posts that suggested how to change the server to fix ssh delays, I pieced together enough information to find out how to change my client configuration to solve the problem.

The first, and largest cause of delays, was my client and the server working to authenticate me using 'GSSAPI' (Kerberos) authentication. That seemed to be a good 15-18 seconds of the delay. I fixed this problem by adding a configuration file for my user that disabled GSSAPI authentication for the host. The file I added is ~/.ssh/config and I created it to read:
Host -host-name-here-
 GSSAPIAuthentication no
 GSSAPIKeyExchange no
Where -host-name-here- is replaced with the name of the host so that it matches whatever you type into the ssh command. If you want to disable GSSAPIAuthentication for all hosts you can use an asterisk '*' as a wildcard host name.

That took the delay down to about a second or two. Based on another hint found in this forum, I discovered that the Mac also tries to negotiate with the server through both IPv4 and IPv6 channels. This server doesn't do IPv6 so I changed my ssh config to read:
Host -host-name-here-
 GSSAPIAuthentication no
 GSSAPIKeyExchange no
 AddressFamily inet
This forces ssh to use only IPv4 and made my ssh connections almost instantaneous.

[crarko adds: I haven't tested this one.]
    •    
  • Currently 4.33 / 5
  You rated: 5 / 5 (6 votes cast)
 
[8,316 views]  

10.7: Removing a Delay in SSH commands to some hosts | 11 comments | Create New Account
Click here to return to the '10.7: Removing a Delay in SSH commands to some hosts' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
10.7: Removing a Delay in SSH commands to some hosts
Authored by: devlogic on Oct 25, '11 07:57:12AM
And as an added bonus, if you know that you're always in IPv4 and/or non-kerberos networks, you can put all 3 of those options below the heading
Host *
You can also add specific exceptions for hosts that do happen to support Kerberos by adding in reverse settings (like GSSAPIAuthentication yes) under a host-specific heading. Re-enabling IPv6 is left as an exercise for the reader; see man 5 ssh_config for details.

[ Reply to This | # ]
10.7: Removing a Delay in SSH commands to some hosts
Authored by: Portelly on Oct 25, '11 09:14:11AM

Work like a charm.
Never thought i can remove this delay.



[ Reply to This | # ]
10.7: Removing a Delay in SSH commands to some hosts
Authored by: TrumpetPower! on Oct 25, '11 09:44:09AM

It's worth noting that most (but obviously not all) such delays are caused by DNS problems.

Cheers,

b&



[ Reply to This | # ]
10.7: Removing a Delay in SSH commands to some hosts
Authored by: pnaro on Oct 25, '11 10:11:48AM

Ran into this on my debian boxes.


add "UseDNS no" to bottom of /etc/sshd_config



[ Reply to This | # ]
10.7: Removing a Delay in SSH commands to some hosts
Authored by: -PhS- on Oct 25, '11 01:19:32PM
Thank you for this tip ... I have also another issue with ssh on 10.7 ... X breaks!

I mean ssh -X user@linuxhost works fine .... but there a sort of time out, after 5 - 10 min or so, the X applications are not able to connect back ?

all I get is "Error: cannot open display: localhost:11.0"

no issue on my 10.6 ... but 10.7 definitely doesn't work for me, do you have any suggestion ?

[ Reply to This | # ]

10.7: Removing a Delay in SSH commands to some hosts
Authored by: strobe33333 on Oct 25, '11 01:43:53PM

To briefly expand on TrumpetPower's comment;

When the delay is related to name resolution, it is usually that the hostname itself has not been properly configured properly. The fast/cheap way to fix it is to add the destination hostname to /etc/hosts on the destination host itself. Once in, you should resolve the overarching hostname configuration/name resolution issue.



[ Reply to This | # ]
10.7: Removing a Delay in SSH commands to some hosts
Authored by: keith_rollin on Oct 25, '11 04:57:30PM
Thankfully, my new SSH connections don't suffer the problem described above. But I did find that I could largely eliminate the (already smallish) delay on subsequent connections to the same server by using the following:
HOST *
        CONTROLMASTER auto
        CONTROLPATH /tmp/ssh-%r@%h:%p
Those options allow the re-use of a single connection for multiple sessions. You can learn more about them in `man ssh_config`.

[ Reply to This | # ]
10.7: Removing a Delay in SSH commands to some hosts
Authored by: lowbatteries on Oct 25, '11 09:10:01PM

I recently noticed my SSH connections becoming very slow - turns out it was my ISP's DNS servers. In the first instance, I would try http://code.google.com/p/namebench/ to find out the best DNS servers for you. I personally use 4.2.2.2 and 8.8.8.8 for all my machines.



[ Reply to This | # ]
10.7: Removing a Delay in SSH commands to some hosts
Authored by: jaydisc on Oct 25, '11 09:55:22PM

Wow, the IPv4 made a huge difference for me. Thank you!



[ Reply to This | # ]
10.7: Removing a Delay in SSH commands to some hosts
Authored by: lihtox on Oct 25, '11 10:39:29PM

Any reason this is marked as a 10.7 hint? Is it not valid for earlier OSes?



[ Reply to This | # ]
10.7 only?
Authored by: dronkert on Oct 26, '11 04:50:46AM

No idea but perhaps the GSSAPI (Kerberos) options in 10.7 default to 'yes'? They do to 'no' on 10.6.



[ Reply to This | # ]