SSH with GSSAPI or public keys slowdown

by Juliet Kemp

As of this morning, I found that ssh logins into my Debian etch boxes were monumentally slow. Using the -vvv switch it looked like the problem was down to a very long wait for gssapi-with-mic authentication. Trying with the -o GSSAPIAuthentication=no switch on the command line helped, although some boxes were also pausing for a very long time when dealing with public-key auth.

Upgrading to the unstable package of openssh-server seems to have fixed the problem; although I can't find anything explicit in the bug reports. Since libkrb53 was upgraded recently I'm wondering whether the source of the issue is actually in there.

However, note that if you've previously had ssh-krb5 installed, and have had the upgrade to openssh-server occur, you may have an old ssh-krb5 process kicking around. I found that in general, /etc/init.d/ssh-krb5 didn't get removed; /etc/init.d/ssh just got installed alongside it, so be careful when rebooting.


3 Comments

Eldon Ziegler
2007-03-13 04:24:31
Thank you for posting this. I ran into the same thing and setting GSSAPIAuthentication=no in .ssh/config got rid of the delay. It seemed to start after a recent update to Fedora 5. The man page ssh_config says GSSAPIAuthentication is no by default but that seems not to be the case.
noname
2007-03-13 10:26:44
Please can you post the bug report link for this?
TIm Retout
2007-05-13 08:16:16
@noname: Bug #409360