ssh远程登录连接慢的解决方法

近期在搭建自动化集群服务，写脚本ssh批量分发公钥至其它服务器时比较缓慢，便在度娘上寻找解决方法如下：

方法一：

以ssh -v 调试模式远程登录：

[root@bqh-nfs-123 ceshi]# ssh -v -p22 root@192.168.43.117 /sbin/ifconfig eth0
OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to 192.168.43.117 [192.168.43.117] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/identity type -1
debug1: identity file /root/.ssh/identity-cert type -1
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: identity file /root/.ssh/id_dsa type 2
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host '192.168.43.117' is known and matches the RSA host key.
debug1: Found key in /root/.ssh/known_hosts:1
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received  #①
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug1: Next authentication method: gssapi-with-mic #②
debug1: Unspecified GSS failure.  Minor code may provide more information
Cannot determine realm for numeric host address

debug1: Unspecified GSS failure.  Minor code may provide more information
Cannot determine realm for numeric host address

debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/identity
debug1: Trying private key: /root/.ssh/id_rsa
debug1: Offering public key: /root/.ssh/id_dsa
debug1: Server accepts key: pkalg ssh-dss blen 434
debug1: read PEM private key done: type DSA
debug1: Authentication succeeded (publickey).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: Sending environment.
debug1: Sending env LANG = zh_CN.UTF-8
debug1: Sending command: /sbin/ifconfig eth0
eth0      Link encap:Ethernet  HWaddr 00:0C:29:71:FC:1E  
          inet addr:192.168.43.117  Bcast:192.168.43.255  Mask:255.255.255.0
          inet6 addr: 2408:84e5:1087:3898:20c:29ff:fe71:fc1e/64 Scope:Global
          inet6 addr: fe80::20c:29ff:fe71:fc1e/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:3078 errors:0 dropped:0 overruns:0 frame:0
          TX packets:825 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:238989 (233.3 KiB)  TX bytes:84709 (82.7 KiB)

debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: client_input_channel_req: channel 0 rtype eow@openssh.com reply 0
debug1: channel 0: free: client-session, nchannels 1
Transferred: sent 2552, received 3088 bytes, in 0.0 seconds
Bytes per second: sent 100007.1, received 121011.8
debug1: Exit status 0

根据ssh调试信息，观察执行缓慢的开始位置：

• 若在debug1: SSH2_MSG_SERVICE_ACCEPT received (位置①) 开始慢，则需要修改服务端的文件均resolv.conf
• 若在debug1: Next authentication method: gssapi-with-mic (位置②) 开始慢，则需要修改客户端的文件resolv.conf
• 若两者都慢，则客户端和服务端都需要修改文件resolv.conf

方法二：

_{1、关闭DNS反向解析}
在linux中，默认就是开启了SSH的反向DNS解析,这个会消耗大量时间，因此需要关闭。
# vi /etc/ssh/sshd_config
UseDNS=no

_{2、关闭SERVER上的GSS认证}
在authentication gssapi-with-mic有很大的可能出现问题，因此关闭GSS认证可以提高ssh连接速度。
# vi /etc/ssh/sshd_config
GSSAPIAuthentication no

3、修改server上nsswitch.conf文件

# vi /etc/nsswitch.conf
找到
hosts： files dns
改为
hosts：files

hosts： files dns 表示是对于访问的主机进行域名解析的顺序，是先访问file，也就是/etc/hosts文件，如果hosts中没有记录域名，则访问dns，进行域名解析，如果dns也无法访问，就会等待访问超时后返回，因此等待时间比较长。
注意：如果SERVER需要通过域名访问其他服务器，则需要保留此行。
4、打开SERVER上的IgnoreRhosts参数
IgnoreRhosts参数可以忽略以前登录过主机的记录，设置为yes后可以极大的提高连接速度
# vi /etc/ssh/sshd_config
IgnoreRhosts yes

5、修改客户端配置文件ssh_conf（注意，不是sshd_conf）
# vi /etc/ssh/ssh_conf
GSSAPIAuthentication no