Bug#413846: openssh-client: post-4.3p2-6 openssh gets kerberos-related hang (non-root only)
Jim Meyering <jim@meyering.net> writes:
> I've just compared root and non-root strace output
> for that case and discovered an interaction with kerberos.
> Not surprisingly, turning off GSSAPIAuthentication solves the problem.
> I.e., this works just fine:
> ssh -o 'GSSAPIAuthentication no' git.debian.org date
> Since GSSAPIAuthentication=yes seems to be the default,
> I suspect this will affect others with a kerberos config
> that refers to an authority that isn't always accessible.
> Or maybe ssh is just the messenger and this is really a kerberos problem...
Another user tracked this down to weird problems with DNS resolution
caused by, I *think*, Avahi. Do you have that installed on your system?
The only real difference between GSSAPI being enabled and not being
enabled is that ssh will do some additional DNS queries when GSSAPI is
enabled, but something that makes DNS queries extremely slow will show up
as slowness in ssh.
Based on the previous bug about this, my feeling on it was that it was a
bug in the DNS stuff that was causing DNS resolution to be slow, but I'm
not sure I completely understood the issue.
--
Russ Allbery (rra@debian.org) <http://www.eyrie.org/~eagle/>
Reply to: