12

Every time I ssh login to a server, it is always very slow. As a reply to my earlier post said, "grepping through a 200 line file should take millisecond or so, so I would doubt it's that."

I tried ssh -vvv time@server and the output has been uploaded here. I found that when proceeding to each of these three lines in the output, it is particularly slow:

debug1: Next authentication method: gssapi-with-mic 

debug1: Unspecified GSS failure.  Minor code may provide more information
Credentials cache file '/tmp/krb5cc_1000' not found 


debug1: Unspecified GSS failure.  Minor code may provide more information
Credentials cache file '/tmp/krb5cc_1000' not found

I wonder why and what I can do to change it? Thanks and regards!

Update:

Ignacio's reply suggests me to "disable all GSS/Kerberos auth methods in your configuration."

So in /etc/ssh/ssh_config, do I have to make sure "no" is behind each of all options starting with "GSS": GSSAPIAuthentication, GSSAPIDelegateCredentials, GSSAPIKeyExchange, GSSAPITrustDNS, GSSAPIAuthentication, and GSSAPIDelegateCredentials?

Then what are the options for "Kerberos" auth method that I need to put "no" behind?

PS: following is the content of my local /etc/ssh/ssh_config with commented options not copied to here:

Host *
    SendEnv LANG LC_*
    HashKnownHosts yes
    GSSAPIAuthentication yes
    GSSAPIDelegateCredentials no
Jeff Schaller
  • 67,283
  • 35
  • 116
  • 255
Tim
  • 101,790

4 Answers4

15
debug1: Next authentication method: gssapi-with-mic

That's Kerberos. Disable all GSS/Kerberos auth methods in your configuration. See the ssh_config(5) man page, PreferredAuthentications option, for more details.

Ignacio Vazquez-Abrams
  • 45,725
  • Thanks! By "your configuration", you mean my local one or the remote server's? – Tim Jan 19 '12 at 01:45
  • PreferredAuthentications is on the client. On the server, use GSSAPIAuthentication instead. – Ignacio Vazquez-Abrams Jan 19 '12 at 01:48
  • 1
    Thanks! So in /etc/ssh/ssh_config, (1) do I have to make sure "no" is behind each of all options starting with "GSS": GSSAPIAuthentication, GSSAPIDelegateCredentials, GSSAPIKeyExchange, GSSAPITrustDNS, GSSAPIAuthentication, and GSSAPIDelegateCredentials? (2) what are the options for "Kerberos" auth method that I need to put "no" behind?

    PS: I just updated my post with the content of my local /etc/ssh/ssh_config.

     – Tim Jan 19 '12 at 02:02
  • 1
  • Modifying PreferredAuthentications is enough. 2. Kerberos uses GSS; disabling GSS is enough.
    • – Ignacio Vazquez-Abrams Jan 19 '12 at 02:06
  • Thanks! May I ask how to modify PreferredAuthentications? I cannot find it in ssh_config(5) manpage – Tim Jan 19 '12 at 02:10
  • Which version are you running that doesn't have it? – Ignacio Vazquez-Abrams Jan 19 '12 at 02:15
  • ssh version is OpenSSH_5.5p1 Debian-4ubuntu6, OpenSSL 0.9.8o 01 Jun 2010. I can't find PreferredAuthentications in my /etc/ssh/ssh_config file for me to modify. – Tim Jan 19 '12 at 02:20
  • I put PreferredAuthentications no in my /etc/ssh/ssh_config, but it doesn't work because ofPermission denied (publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive). – Tim Jan 20 '12 at 00:16
  • Thank you; you solved my debilitating problem waiting 60 seconds to SSH into RedHat servers. – PP. Jun 21 '13 at 10:52
  • 1
    Leverage the SSH client config.d directory: Create a file /etc/ssh/ssh_config.d/10-gssapiauthentication-no.conf with the following content: GSSAPIAuthentication no ... And notice this is with directory /etc/ssh/ssh_config.d/, ... not /etc/ssh/sshd_config.d/ ... Because this is an SSH client configuration, not an SSH server configuration. – Abdull Feb 07 '23 at 18:22