sshd and GSSAPI

Filed under: sshd gssapi 

I've been having a problem for a while that seems to span whatever Linux distro I'm using. It seems to affect both Gentoo and Fedora in any case.

If I ssh into a server, there's an interminably long delay. Running "ssh -v host" outputs something like:

debug1: Authentications that can continue: publickey,gssapi-with-mic,password
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
No credentials cache found

This delay is really long. For example, to ssh to my media server in the basement (802.11n to gigabit) can take over 30 seconds before it asks for a password.

Here's the fix I found: set the following in /etc/ssh/sshd_config:

# GSSAPI options
GSSAPIAuthentication no
GSSAPICleanupCredentials no

Frankly I have no idea what this is. I use key-based authentication almost exclusively and that continues to work, so I don't think I care.

In any case, if someone knows if this opens a potential security exploit or why it would cause the connection to take so long, drop a note here.



2 comments Leave a comment