ssh遠程登陸鏈接慢的解決方法

近期在搭建自動化集羣服務，寫腳本ssh批量分發公鑰至其它服務器時比較緩慢，便在度娘上尋找解決方法以下：

方法一：

以ssh -v 調試模式遠程登陸：

[root@bqh-nfs-123 ceshi]# ssh -v -p22 root@192.168.43.117 /sbin/ifconfig eth0
OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to 192.168.43.117 [192.168.43.117] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/identity type -1
debug1: identity file /root/.ssh/identity-cert type -1
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: identity file /root/.ssh/id_dsa type 2
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host '192.168.43.117' is known and matches the RSA host key.
debug1: Found key in /root/.ssh/known_hosts:1
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received #①
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug1: Next authentication method: gssapi-with-mic #②
debug1: Unspecified GSS failure.  Minor code may provide more information
Cannot determine realm for numeric host address

debug1: Unspecified GSS failure.  Minor code may provide more information
Cannot determine realm for numeric host address

debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/identity
debug1: Trying private key: /root/.ssh/id_rsa
debug1: Offering public key: /root/.ssh/id_dsa
debug1: Server accepts key: pkalg ssh-dss blen 434
debug1: read PEM private key done: type DSA
debug1: Authentication succeeded (publickey).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: Sending environment.
debug1: Sending env LANG = zh_CN.UTF-8
debug1: Sending command: /sbin/ifconfig eth0
eth0      Link encap:Ethernet  HWaddr 00:0C:29:71:FC:1E  
          inet addr:192.168.43.117  Bcast:192.168.43.255  Mask:255.255.255.0
          inet6 addr: 2408:84e5:1087:3898:20c:29ff:fe71:fc1e/64 Scope:Global
          inet6 addr: fe80::20c:29ff:fe71:fc1e/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:3078 errors:0 dropped:0 overruns:0 frame:0
          TX packets:825 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:238989 (233.3 KiB)  TX bytes:84709 (82.7 KiB)

debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: client_input_channel_req: channel 0 rtype eow@openssh.com reply 0
debug1: channel 0: free: client-session, nchannels 1
Transferred: sent 2552, received 3088 bytes, in 0.0 seconds
Bytes per second: sent 100007.1, received 121011.8
debug1: Exit status 0

根據ssh調試信息，觀察執行緩慢的開始位置：

• 若在debug1: SSH2_MSG_SERVICE_ACCEPT received (位置①) 開始慢，則須要修改服務端的文件均resolv.conf
• 若在debug1: Next authentication method: gssapi-with-mic (位置②) 開始慢，則須要修改客戶端的文件resolv.conf
• 若二者都慢，則客戶端和服務端都須要修改文件resolv.conf

 

方法二：

_{一、關閉DNS反向解析}
在linux中，默認就是開啓了SSH的反向DNS解析,這個會消耗大量時間，所以須要關閉。
# vi /etc/ssh/sshd_config
UseDNS=no

_{二、關閉SERVER上的GSS認證}
在authentication gssapi-with-mic有很大的可能出現問題，所以關閉GSS認證能夠提升ssh鏈接速度。
# vi /etc/ssh/sshd_config
GSSAPIAuthentication no

三、修改server上nsswitch.conf文件

# vi /etc/nsswitch.conf
找到
hosts： files dns
改成
hosts：files

hosts： files dns 表示是對於訪問的主機進行域名解析的順序，是先訪問file，也就是/etc/hosts文件，若是hosts中沒有記錄域名，則訪問dns，進行域名解析，若是dns也沒法訪問，就會等待訪問超時後返回，所以等待時間比較長。
注意：若是SERVER須要經過域名訪問其餘服務器，則須要保留此行。
四、打開SERVER上的IgnoreRhosts參數
IgnoreRhosts參數能夠忽略之前登陸過主機的記錄，設置爲yes後能夠極大的提升鏈接速度
# vi /etc/ssh/sshd_config
IgnoreRhosts yes

五、修改客戶端配置文件ssh_conf（注意，不是sshd_conf）
# vi /etc/ssh/ssh_conf
GSSAPIAuthentication no