Bug 1318

Summary:	There is no way to really cancel dns queries from the client
Product:	Portable OpenSSH	Reporter:	Eyal Lotem <eyal.lotem>
Component:	ssh	Assignee:	Assigned to nobody <unassigned-bugs>
Status:	CLOSED WORKSFORME
Severity:	normal	CC:	djm
Priority:	P2
Version:	4.3p2
Hardware:	Other
OS:	Linux

Description Eyal Lotem 2007-05-25 05:49:12 AEST

The option "CheckHostIP no" cancels ssh's lookup, but the ssh clinet still calls gss_import_name with the parameter GSS_C_NT_HOSTBASED_SERVICE. This call creates a name lookup internally (via gss's call to krb5_sname_to_principal).

This causes "ssh" to always attempt to backresolve IP addresses. It only gives up after about 10 seconds. This means that all ssh-based traffic (ssh, sftp, etc) requires a 10 second initiation time (!) before it can work, unless adding the private network IP addresses to /etc/hosts.

I think "ssh" is the last tool I have left that still insists on backresolving my private net IP's, and I would rather not pollute /etc/hosts with private addresses.

Comment 1 Damien Miller 2007-06-13 10:29:05 AEST

Setting GSSAPIAuthentication=no in ssh_config will disable these lookups.

Comment 2 Damien Miller 2008-04-04 09:59:46 AEDT

Close resolved bugs after release.