sshd and GSSAPI
Filed under: sshd gssapiI've been having a problem for a while that seems to span whatever Linux distro I'm using. It seems to affect both Gentoo and Fedora in any case.
If I ssh into a server, there's an interminably long delay. Running "ssh -v host" outputs something like:
debug1: Authentications that can continue: publickey,gssapi-with-mic,password debug1: Next authentication method: gssapi-with-mic debug1: Unspecified GSS failure. Minor code may provide more information No credentials cache found
This delay is really long. For example, to ssh to my media server in the basement (802.11n to gigabit) can take over 30 seconds before it asks for a password.
Here's the fix I found: set the following in /etc/ssh/sshd_config:
# GSSAPI options GSSAPIAuthentication no GSSAPICleanupCredentials no
Frankly I have no idea what this is. I use key-based authentication almost exclusively and that continues to work, so I don't think I care.
In any case, if someone knows if this opens a potential security exploit or why it would cause the connection to take so long, drop a note here.







It's conducting reverse DNS lookups, on the host and the guest. It also looks for automagic kerb setup (more DNS).