CentOS への SSH 接続が遅い時【失敗編】

失敗編です。改善しませんでした。。。
(1秒も早くならなかった ・・・ 変化なし)。

目次

現象

Ubuntu からサーバ(CentOS 7)に SSH で接続を試行すると、パスワード入力が表示されるまでに非常に時間がかかる。
そして、初回に関わらず(何回目でも)遅い。

そして、遅いからと言って放置すると(パスワードを入力しても)以下のように切断される。
(セキュリティの観点からは正しい...)。

$ ssh pc@192.168.9.999
pc@192.168.9.999's password: 
Connection closed by 192.168.9.999 port 22

原因の確認

マニュアルを観ると ssh には Verbose mode(詳細モード:接続プロセスをテキストベースで表示するモード)があるようです。

man ssh

 -v      Verbose mode.  Causes ssh to print debugging messages about its
         progress.  This is helpful in debugging connection, authentica‐
         tion, and configuration problems.  Multiple -v options increase
         the verbosity.  The maximum is 3.

ロギング

Verbose mode を有効にした状態で ssh 接続を試してログを取得します。

  • 接続元
    192.168.9.999(Lubuntu)
  • 接続先
    192.168.9.888(CentOS)
$ ssh -v user@192.168.9.999
OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n  7 Dec 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 192.168.9.999 [192.168.9.999] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ed25519-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 192.168.9.999:22 as 'user'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:RpohaXeG0aGzFg7xFp7oWzepJ+rmWKIruw7FMZL//Hc
debug1: Host '192.168.9.999' is known and matches the ECDSA host key.
debug1: Found key in /home/user/.ssh/known_hosts:10
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000)

debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000)

debug1: Next authentication method: publickey
debug1: Trying private key: /home/user/.ssh/id_rsa
debug1: Trying private key: /home/user/.ssh/id_dsa
debug1: Trying private key: /home/user/.ssh/id_ecdsa
debug1: Trying private key: /home/user/.ssh/id_ed25519
debug1: Next authentication method: password
user@192.168.9.999's password: 
debug1: Authentication succeeded (password).
Authenticated to 192.168.9.999 ([192.168.9.999]:22).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: network
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
debug1: Sending environment.
debug1: Sending env LANG = ja_JP.UTF-8
Last login: Sat Dec 14 20:49:49 2019 from 192.168.9.888
$ ssh -v user@192.168.9.999
OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n  7 Dec 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 192.168.9.999 [192.168.9.999] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ed25519-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 192.168.9.999:22 as 'user'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxx+rmWKIruw7FMZL//Hc
debug1: Host '192.168.9.999' is known and matches the ECDSA host key.
debug1: Found key in /home/user/.ssh/known_hosts:10
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000)

debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000)

debug1: Next authentication method: publickey
debug1: Trying private key: /home/user/.ssh/id_rsa
debug1: Trying private key: /home/user/.ssh/id_dsa
debug1: Trying private key: /home/user/.ssh/id_ecdsa
debug1: Trying private key: /home/user/.ssh/id_ed25519
debug1: Next authentication method: password
user@192.168.9.999's password: 
debug1: Authentication succeeded (password).
Authenticated to 192.168.9.999 ([192.168.9.999]:22).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: network
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
debug1: Sending environment.
debug1: Sending env LANG = ja_JP.UTF-8
Last login: Sat Dec 14 20:49:49 2019 from 192.168.9.888

ログ確認

今回の ssh 接続では、以下に時間がかかっていました。

  • パスワード入力表示までに時間がかかる

上記を踏まえると、どうやら下記の部分が怪しそうです。
※つまり「user@192.168.9.999's password:」までが時間がかかっている部分になります。

debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000)

しっかりと failure(失敗)と出力されています。。。

ここでの GSS とは、GSS-API を指します。
そして、それを ssh 利用時に使う設定になっていて、且つ GSS-API が使えない時に当減少が発生する模様。

なお、GSS-API とは認証情報を保護する仕組みです。

base on https://docs.oracle.com/cd/E19455-01/806-4504/6jdj2sbhk/index.html
2010, Oracle Corporation and/or its affiliates
Generic Security Standard Application Programming Interface (GSS-API) は、ピアとなるアプリケーションに送信されるデータを保護する方法をアプリケーションに提供します。

base on 認証方式

19.3.3. GSSAPI認証
GSSAPIは、RFC 2743で定義されている安全な認証のための業界標準のプロトコルです。 PostgreSQLは、RFC 1964によりKerberos認証と共にGSSAPIをサポートします。
GSSAPIは、GSSAPIをサポートしているシステムに対して自動認証(シングルサインオン)を提供します。
認証自体は安全ですが、データベース接続を通じて送信されるデータは、SSLが使用されていない場合は平文となります。

対処

ssh 設定ファイル(sshd_config)に GSS-API の使用有無を設定する項目があるので、これを利用します。

# diff -u /tmp/ssh_config /etc/ssh/ssh_config 
--- /tmp/ssh_config 2019-12-14 21:23:13.225487905 +0900
+++ /etc/ssh/ssh_config 2019-12-14 22:40:08.462016117 +0900
@@ -17,20 +17,20 @@
 # list of available options, their meanings and defaults, please see the
 # ssh_config(5) man page.

-Host *
+#Host *
 #   ForwardAgent no
 #   ForwardX11 no
 #   RhostsRSAAuthentication no
 #   RSAAuthentication yes
-#   PasswordAuthentication yes
+PasswordAuthentication yes
 #   HostbasedAuthentication no
-#   GSSAPIAuthentication no
-#   GSSAPIDelegateCredentials no
-#   GSSAPIKeyExchange no
-#   GSSAPITrustDNS no
+GSSAPIAuthentication no
+GSSAPIDelegateCredentials no
+GSSAPIKeyExchange no
+GSSAPITrustDNS no
 #   BatchMode no
 #   CheckHostIP yes
-#   AddressFamily any
+AddressFamily inet
 #   ConnectTimeout 0
 #   StrictHostKeyChecking ask
 #   IdentityFile ~/.ssh/identity
@@ -55,8 +55,7 @@
 # Host *.local
 #   CheckHostIP no

-Host *
-   GSSAPIAuthentication yes
+#Host *
 # If this option is set to yes then remote X11 clients will have full access
 # to the original X11 display. As virtually no X11 client supports the untrusted
 # mode correctly we set this to yes.
@@ -66,3 +65,5 @@
    SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
    SendEnv LC_IDENTIFICATION LC_ALL LANGUAGE
    SendEnv XMODIFIERS
+
+UseDNS no

設定項目の概要

  • PasswordAuthentication
    パスワードでの認証を許可する。

  • GSSAPIAuthentication

  • GSSAPIDelegateCredentials
  • GSSAPIKeyExchange
  • GSSAPITrustDNS
    GSS-API 関連の設定。

  • AddressFamily
    IPv4, IPv6 を指定できる。

    • IPv4 のみを使用: inet
    • IPv6 のみを使用: inet6
  • UseDNS
    名前解決を使用するか否か。

  • Host
    当該設定を利用するホストを絞れる。

結果

ググった結果を全て試しても・・・全く変化なし。

乞うご期待