近期在搭建自动化集群服务，写脚本ssh批量分发公钥至其它服务器时比较缓慢，便在度娘上寻找解决方法如下：
方法一：
以ssh -v 调试模式远程登录：
[root@bqh-nfs-123 ceshi]# ssh -v -p22 root@192.168.43.117 /sbin/ifconfig eth0 OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013 debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Connecting to 192.168.43.117 [192.168.43.117] port 22. debug1: Connection established. debug1: permanently_set_uid: 0/0 debug1: identity file /root/.ssh/identity type -1 debug1: identity file /root/.ssh/identity-cert type -1 debug1: identity file /root/.ssh/id_rsa type -1 debug1: identity file /root/.ssh/id_rsa-cert type -1 debug1: identity file /root/.ssh/id_dsa type 2 debug1: identity file /root/.ssh/id_dsa-cert type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3 debug1: match: OpenSSH_5.3 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_5.3 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-ctr hmac-md5 none debug1: kex: client->server aes128-ctr hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug1: Host '192.168.43.117' is known and matches the RSA host key. debug1: Found key in /root/.ssh/known_hosts:1 debug1: ssh_rsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received #① debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password debug1: Next authentication method: gssapi-keyex debug1: No valid Key exchange context debug1: Next authentication method: gssapi-with-mic #② debug1: Unspecified GSS failure. Minor code may provide more information Cannot determine realm for numeric host address debug1: Unspecified GSS failure. Minor code may provide more information Cannot determine realm for numeric host address debug1: Next authentication method: publickey debug1: Trying private key: /root/.ssh/identity debug1: Trying private key: /root/.ssh/id_rsa debug1: Offering public key: /root/.ssh/id_dsa debug1: Server accepts key: pkalg ssh-dss blen 434 debug1: read PEM private key done: type DSA debug1: Authentication succeeded (publickey). debug1: channel 0: new [client-session] debug1: Requesting no-more-sessions@openssh.com debug1: Entering interactive session. debug1: Sending environment. debug1: Sending env LANG = zh_CN.UTF-8 debug1: Sending command: /sbin/ifconfig eth0 eth0 Link encap:Ethernet HWaddr 00:0C:29:71:FC:1E inet addr:192.168.43.117 Bcast:192.168.43.255 Mask:255.255.255.0 inet6 addr: 2408:84e5:1087:3898:20c:29ff:fe71:fc1e/64 Scope:Global inet6 addr: fe80::20c:29ff:fe71:fc1e/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:3078 errors:0 dropped:0 overruns:0 frame:0 TX packets:825 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:238989 (233.3 KiB) TX bytes:84709 (82.7 KiB) debug1: client_input_channel_req: channel 0 rtype exit-status reply 0 debug1: client_input_channel_req: channel 0 rtype eow@openssh.com reply 0 debug1: channel 0: free: client-session, nchannels 1 Transferred: sent 2552, received 3088 bytes, in 0.0 seconds Bytes per second: sent 100007.1, received 121011.8 debug1: Exit status 0
根据ssh调试信息，观察执行缓慢的开始位置：
- 若在debug1: SSH2_MSG_SERVICE_ACCEPT received (位置①) 开始慢，则需要修改服务端的文件均resolv.conf
- 若在debug1: Next authentication method: gssapi-with-mic (位置②) 开始慢，则需要修改客户端的文件resolv.conf
- 若两者都慢，则客户端和服务端都需要修改文件resolv.conf
方法二：
1、关闭DNS反向解析
在linux中，默认就是开启了SSH的反向DNS解析,这个会消耗大量时间，因此需要关闭。
# vi /etc/ssh/sshd_config
UseDNS=no
2、关闭SERVER上的GSS认证
在authentication gssapi-with-mic有很大的可能出现问题，因此关闭GSS认证可以提高ssh连接速度。
# vi /etc/ssh/sshd_config
GSSAPIAuthentication no
3、修改server上nsswitch.conf文件
# vi /etc/nsswitch.conf
找到
hosts： files dns
改为
hosts：files
hosts： files dns 表示是对于访问的主机进行域名解析的顺序，是先访问file，也就是/etc/hosts文件，如果hosts中没有记录域名，则访问dns，进行域名解析，如果dns也无法访问，就会等待访问超时后返回，因此等待时间比较长。
注意：如果SERVER需要通过域名访问其他服务器，则需要保留此行。
4、打开SERVER上的IgnoreRhosts参数
IgnoreRhosts参数可以忽略以前登录过主机的记录，设置为yes后可以极大的提高连接速度
# vi /etc/ssh/sshd_config
IgnoreRhosts yes
5、修改客户端配置文件ssh_conf（注意，不是sshd_conf）
# vi /etc/ssh/ssh_conf
GSSAPIAuthentication no