SSH Login Delay Caused By Reverse DNS Lookups

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

SSH authentication is valid but terminal prompt appears after long pauses.

Environment & Reproduction

Reverse DNS or GSSAPI negotiation delays occur before session handoff.

Root Cause Analysis

Use journalctl -u sshd -b to locate timing gaps around connection handling.

Quick Triage

Run host and dig -x to check reverse lookup latency.

Step-by-Step Diagnosis

Set UseDNS no and, if appropriate, GSSAPIAuthentication no in /etc/ssh/sshd_config.

Solution – Primary Fix

Run sshd -t then systemctl restart sshd to activate validated settings.

Solution – Alternative Approaches

Retest with ssh -vvv to confirm immediate key exchange and prompt delivery.

Verification & Acceptance Criteria

If DNS is required, fix upstream resolver performance and PTR correctness.

Rollback Plan

Ensure outbound DNS traffic is not blocked for resolver reachability.

Prevention & Hardening

Admin response times degrade and automation sessions can hit command timeouts.

Related Errors & Cross-Refs

Keep strong auth methods enabled even when optimizing login speed.

Related tutorial: View the step-by-step tutorial for rhel-9.

View all rhel-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Include sshd_config baseline checks and DNS health tests in host provisioning.