ssh远程登录连接慢的解决方法

近期在搭建自动化集群服务，写脚本ssh批量分发公钥至其它服务器时比较缓慢，便在度娘上寻找解决方法如下：

方法一：

以ssh -v 调试模式远程登录：

[root@bqh-nfs- ceshi]# ssh -v -p22 root@192.168.43.117 /sbin/ifconfig eth0
OpenSSH_5.3p1, OpenSSL 1.0.1e-fips  Feb
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to 192.168.43.117 [192.168.43.117] port .
debug1: Connection established.
debug1: permanently_set_uid: /
debug1: identity file /root/.ssh/identity type -
debug1: identity file /root/.ssh/identity-cert type -
debug1: identity file /root/.ssh/id_rsa type -
debug1: identity file /root/.ssh/id_rsa-cert type -
debug1: identity file /root/.ssh/id_dsa type
debug1: identity file /root/.ssh/id_dsa-cert type -
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.
debug1: match: OpenSSH_5. pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(<<) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host '192.168.43.117' is known and matches the RSA host key.
debug1: Found key in /root/.ssh/known_hosts:
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received  #①
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug1: Next authentication method: gssapi-with-mic #②
debug1: Unspecified GSS failure.  Minor code may provide more information
Cannot determine realm for numeric host address

debug1: Unspecified GSS failure.  Minor code may provide more information
Cannot determine realm for numeric host address

debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/identity
debug1: Trying private key: /root/.ssh/id_rsa
debug1: Offering public key: /root/.ssh/id_dsa
debug1: Server accepts key: pkalg ssh-dss blen
debug1: read PEM private key done: type DSA
debug1: Authentication succeeded (publickey).
debug1: channel : new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: Sending environment.
debug1: Sending env LANG = zh_CN.UTF-
debug1: Sending command: /sbin/ifconfig eth0
eth0      Link encap:Ethernet  HWaddr :0C:::FC:1E
          inet addr:192.168.43.117  Bcast:192.168.43.255  Mask:255.255.255.0
          inet6 addr: :84e5:::20c:29ff:fe71:fc1e/ Scope:Global
          inet6 addr: fe80::20c:29ff:fe71:fc1e/ Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:  Metric:
          RX packets: errors: dropped: overruns: frame:
          TX packets: errors: dropped: overruns: carrier:
          collisions: txqueuelen:
          RX bytes: (233.3 KiB)  TX bytes: (82.7 KiB)

debug1: client_input_channel_req: channel  rtype exit-status reply
debug1: client_input_channel_req: channel  rtype eow@openssh.com reply
debug1: channel : free: client-session, nchannels
Transferred: sent , received  bytes, in 0.0 seconds
Bytes per second: sent 100007.1, received 121011.8
debug1: Exit status 

根据ssh调试信息，观察执行缓慢的开始位置：

• 若在debug1: SSH2_MSG_SERVICE_ACCEPT received (位置①) 开始慢，则需要修改服务端的文件均resolv.conf
• 若在debug1: Next authentication method: gssapi-with-mic (位置②) 开始慢，则需要修改客户端的文件resolv.conf
• 若两者都慢，则客户端和服务端都需要修改文件resolv.conf

方法二：

_{1、关闭DNS反向解析}
在linux中，默认就是开启了SSH的反向DNS解析,这个会消耗大量时间，因此需要关闭。
# vi /etc/ssh/sshd_config
UseDNS=no

_{2、关闭SERVER上的GSS认证}
在authentication gssapi-with-mic有很大的可能出现问题，因此关闭GSS认证可以提高ssh连接速度。
# vi /etc/ssh/sshd_config
GSSAPIAuthentication no

3、修改server上nsswitch.conf文件

# vi /etc/nsswitch.conf
找到
hosts： files dns
改为
hosts：files

hosts： files dns 表示是对于访问的主机进行域名解析的顺序，是先访问file，也就是/etc/hosts文件，如果hosts中没有记录域名，则访问dns，进行域名解析，如果dns也无法访问，就会等待访问超时后返回，因此等待时间比较长。
注意：如果SERVER需要通过域名访问其他服务器，则需要保留此行。
4、打开SERVER上的IgnoreRhosts参数
IgnoreRhosts参数可以忽略以前登录过主机的记录，设置为yes后可以极大的提高连接速度
# vi /etc/ssh/sshd_config
IgnoreRhosts yes

5、修改客户端配置文件ssh_conf（注意，不是sshd_conf）
# vi /etc/ssh/ssh_conf
GSSAPIAuthentication no