Slow SSH login caused by reverse DNS lookup

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

SSH authentication succeeds but shell appears only after long delay, hurting admin productivity and automation.

Environment & Reproduction

RHEL 8 host with `sshd`; connect from client and observe pause post-authentication.

Root Cause Analysis

`UseDNS` reverse lookup waits on slow or unreachable DNS infrastructure.

Quick Triage

Check DNS latency and inspect `sshd` logs in `journalctl -u sshd`.

Step-by-Step Diagnosis

Run `ssh -vvv`, test `dig -x `, and review `/etc/ssh/sshd_config` for DNS and GSSAPI settings.

Solution – Primary Fix

Set `UseDNS no` where policy allows, tune resolver config, restart `sshd`, and retest session startup time.

Solution – Alternative Approaches

Fix reverse DNS records in authoritative zones or deploy local caching resolver for low-latency lookups.

Verification & Acceptance Criteria

Interactive SSH logins consistently complete within acceptable threshold and no lookup timeout warnings appear.

Rollback Plan

Revert `sshd_config` to prior values and reload service if compliance requires DNS-based checks.

Prevention & Hardening

Continuously validate forward and reverse DNS records for managed server subnets.

Related Errors & Cross-Refs

Delayed password prompt, GSSAPI timeouts, and resolver unreachable messages in system logs.

Related tutorial: View the step-by-step tutorial for rhel-8.

View all rhel-8 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

`sshd_config(5)`, RHEL SSH hardening docs, and DNS operations runbooks.