失敗編です。改善しませんでした。。。
（1秒も早くならなかった ・・・ 変化なし）。
目次
現象
Ubuntu からサーバ（CentOS 7）に SSH で接続を試行すると、パスワード入力が表示されるまでに非常に時間がかかる。
そして、初回に関わらず（何回目でも）遅い。
そして、遅いからと言って放置すると（パスワードを入力しても）以下のように切断される。
（セキュリティの観点からは正しい．．．）。
$ ssh pc@192.168.9.999
pc@192.168.9.999's password:
Connection closed by 192.168.9.999 port 22
原因の確認
マニュアルを観ると ssh には Verbose mode（詳細モード：接続プロセスをテキストベースで表示するモード）があるようです。
man ssh
-v Verbose mode. Causes ssh to print debugging messages about its
progress. This is helpful in debugging connection, authentica‐
tion, and configuration problems. Multiple -v options increase
the verbosity. The maximum is 3.
ロギング
Verbose mode を有効にした状態で ssh 接続を試してログを取得します。
- 接続元
192.168.9.999（Lubuntu） - 接続先
192.168.9.888（CentOS）
$ ssh -v user@192.168.9.999
OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n 7 Dec 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 192.168.9.999 [192.168.9.999] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ed25519-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 192.168.9.999:22 as 'user'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:RpohaXeG0aGzFg7xFp7oWzepJ+rmWKIruw7FMZL//Hc
debug1: Host '192.168.9.999' is known and matches the ECDSA host key.
debug1: Found key in /home/user/.ssh/known_hosts:10
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure. Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000)
debug1: Unspecified GSS failure. Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000)
debug1: Next authentication method: publickey
debug1: Trying private key: /home/user/.ssh/id_rsa
debug1: Trying private key: /home/user/.ssh/id_dsa
debug1: Trying private key: /home/user/.ssh/id_ecdsa
debug1: Trying private key: /home/user/.ssh/id_ed25519
debug1: Next authentication method: password
user@192.168.9.999's password:
debug1: Authentication succeeded (password).
Authenticated to 192.168.9.999 ([192.168.9.999]:22).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: network
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
debug1: Sending environment.
debug1: Sending env LANG = ja_JP.UTF-8
Last login: Sat Dec 14 20:49:49 2019 from 192.168.9.888
$ ssh -v user@192.168.9.999
OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n 7 Dec 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 192.168.9.999 [192.168.9.999] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ed25519-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 192.168.9.999:22 as 'user'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxx+rmWKIruw7FMZL//Hc
debug1: Host '192.168.9.999' is known and matches the ECDSA host key.
debug1: Found key in /home/user/.ssh/known_hosts:10
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure. Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000)
debug1: Unspecified GSS failure. Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000)
debug1: Next authentication method: publickey
debug1: Trying private key: /home/user/.ssh/id_rsa
debug1: Trying private key: /home/user/.ssh/id_dsa
debug1: Trying private key: /home/user/.ssh/id_ecdsa
debug1: Trying private key: /home/user/.ssh/id_ed25519
debug1: Next authentication method: password
user@192.168.9.999's password:
debug1: Authentication succeeded (password).
Authenticated to 192.168.9.999 ([192.168.9.999]:22).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: network
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
debug1: Sending environment.
debug1: Sending env LANG = ja_JP.UTF-8
Last login: Sat Dec 14 20:49:49 2019 from 192.168.9.888
ログ確認
今回の ssh 接続では、以下に時間がかかっていました。
- パスワード入力表示までに時間がかかる
上記を踏まえると、どうやら下記の部分が怪しそうです。
※つまり「user@192.168.9.999's password:」までが時間がかかっている部分になります。
debug1: Unspecified GSS failure. Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000)
しっかりと failure（失敗）と出力されています。。。
ここでの GSS とは、GSS-API を指します。
そして、それを ssh 利用時に使う設定になっていて、且つ GSS-API が使えない時に当減少が発生する模様。
なお、GSS-API とは認証情報を保護する仕組みです。
base on https://docs.oracle.com/cd/E19455-01/806-4504/6jdj2sbhk/index.html
2010, Oracle Corporation and/or its affiliates
Generic Security Standard Application Programming Interface (GSS-API) は、ピアとなるアプリケーションに送信されるデータを保護する方法をアプリケーションに提供します。
base on 認証方式
19.3.3. GSSAPI認証
GSSAPIは、RFC 2743で定義されている安全な認証のための業界標準のプロトコルです。 PostgreSQLは、RFC 1964によりKerberos認証と共にGSSAPIをサポートします。
GSSAPIは、GSSAPIをサポートしているシステムに対して自動認証（シングルサインオン）を提供します。
認証自体は安全ですが、データベース接続を通じて送信されるデータは、SSLが使用されていない場合は平文となります。
対処
ssh 設定ファイル（sshd_config）に GSS-API の使用有無を設定する項目があるので、これを利用します。
# diff -u /tmp/ssh_config /etc/ssh/ssh_config
--- /tmp/ssh_config 2019-12-14 21:23:13.225487905 +0900
+++ /etc/ssh/ssh_config 2019-12-14 22:40:08.462016117 +0900
@@ -17,20 +17,20 @@
# list of available options, their meanings and defaults, please see the
# ssh_config(5) man page.
-Host *
+#Host *
# ForwardAgent no
# ForwardX11 no
# RhostsRSAAuthentication no
# RSAAuthentication yes
-# PasswordAuthentication yes
+PasswordAuthentication yes
# HostbasedAuthentication no
-# GSSAPIAuthentication no
-# GSSAPIDelegateCredentials no
-# GSSAPIKeyExchange no
-# GSSAPITrustDNS no
+GSSAPIAuthentication no
+GSSAPIDelegateCredentials no
+GSSAPIKeyExchange no
+GSSAPITrustDNS no
# BatchMode no
# CheckHostIP yes
-# AddressFamily any
+AddressFamily inet
# ConnectTimeout 0
# StrictHostKeyChecking ask
# IdentityFile ~/.ssh/identity
@@ -55,8 +55,7 @@
# Host *.local
# CheckHostIP no
-Host *
- GSSAPIAuthentication yes
+#Host *
# If this option is set to yes then remote X11 clients will have full access
# to the original X11 display. As virtually no X11 client supports the untrusted
# mode correctly we set this to yes.
@@ -66,3 +65,5 @@
SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
SendEnv LC_IDENTIFICATION LC_ALL LANGUAGE
SendEnv XMODIFIERS
+
+UseDNS no
設定項目の概要
- PasswordAuthentication
パスワードでの認証を許可する。 -
GSSAPIAuthentication
- GSSAPIDelegateCredentials
- GSSAPIKeyExchange
-
GSSAPITrustDNS
GSS-API 関連の設定。 -
AddressFamily
IPv4, IPv6 を指定できる。- IPv4 のみを使用： inet
- IPv6 のみを使用： inet6
- UseDNS
名前解決を使用するか否か。 -
Host
当該設定を利用するホストを絞れる。
結果
ググった結果を全て試しても・・・全く変化なし。
乞うご期待