RHEL 8 SSH Login Slow Due to DNS and GSSAPI

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

SSH sessions take 20 to 60 seconds before password or key prompt, slowing operations and automation.

Environment & Reproduction

Run ssh -vvv from client to RHEL 8 host and measure delay between TCP connect and auth prompt.

Root Cause Analysis

Reverse DNS timeout, GSSAPI negotiation delays, or unresolved hostnames in PAM and sudo logs.

Quick Triage

Check journalctl -u sshd, test host -x client IP, and inspect sshd_config for GSSAPIAuthentication.

Step-by-Step Diagnosis

Capture handshake timing with ssh -vvv, validate DNS PTR records, and review NSS resolver order.

Solution – Primary Fix

Correct DNS records and disable unnecessary GSSAPIAuthentication in sshd_config, then systemctl reload sshd.

Solution – Alternative Approaches

Use Match blocks to keep GSSAPI only for domains requiring Kerberos single sign-on.

Verification & Acceptance Criteria

Interactive and automated SSH logins complete within expected latency and no auth regressions occur.

Rollback Plan

Restore previous sshd_config and reload service if domain-auth workflows fail after tuning.

Prevention & Hardening

Continuously validate forward and reverse DNS and maintain hardened, version-controlled sshd policy.

Related Errors & Cross-Refs

Related: Connection established then hangs, PAM timeout, and delayed keyboard-interactive prompt.

Related tutorial: View the step-by-step tutorial for rhel-8.

View all rhel-8 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

See RHEL 8 OpenSSH and DNS integration troubleshooting references.