Troubleshooting SSH Remote Machine Delayed Connection (2 minutes) on Windows 11 and RHEL 9

A two-minute delay during SSH connections from Windows 11 to RHEL 9 is typically caused by the server attempting reverse DNS lookups on the client's IP address or failing to resolve the client's hostname. This process hangs until a timeout occurs, which standardly lasts around 120 seconds. You can resolve this immediately by disabling UseDNS in the SSH daemon configuration or by ensuring your network has proper PTR records.

Understanding the Root Cause

When an SSH client initiates a connection, the server performs several security checks before accepting the login. One of the most common sources of significant latency is the reverse DNS lookup. The SSH daemon (sshd) on the RHEL 9 server attempts to resolve the IP address of the connecting Windows 11 machine back into a hostname. If the DNS server does not have a Pointer (PTR) record for that IP, or if the DNS query times out due to network issues, the server waits for the default timeout period before proceeding. This behavior is governed by the UseDNS directive in the SSH server configuration. By default, many Linux distributions enable this feature to enhance security by verifying that the client's IP matches its hostname. However, in environments where dynamic IP addresses are common or where DNS infrastructure is slow or misconfigured, this check becomes a bottleneck. The two-minute delay is not arbitrary; it aligns closely with the default timeout values for DNS queries in many system configurations. Another potential cause involves the GSSAPI authentication mechanism, which may attempt to negotiate Kerberos tickets even when not explicitly requested, leading to similar timeouts if no Kerberos domain is available.

Disabling Reverse DNS Lookups

The most effective and immediate solution for most users is to disable the reverse DNS lookup on the RHEL 9 server. This change requires modifying the SSH daemon configuration file. You will need root access to edit the file located at /etc/ssh/sshd_config. Open this file using your preferred text editor, such as vim or nano, and search for the line containing UseDNS. If the line is commented out with a hash symbol (#), uncomment it. If it already exists, modify its value. Set the directive to no as shown below:

UseDNS no

After saving the changes, you must restart the SSH service for the new configuration to take effect. On RHEL 9, use the following command:

sudo systemctl restart sshd

This action tells the server to skip the reverse DNS verification step entirely. While this slightly reduces the security overhead associated with hostname verification, it eliminates the network dependency that causes the delay. For most internal networks and development environments, this trade-off is negligible and highly beneficial for user experience. If you are concerned about security, ensure that other controls, such as firewall rules and key-based authentication, are properly configured.

Addressing GSSAPI Authentication Timeouts

Another common culprit for delayed connections is GSSAPI authentication. Even if you do not intend to use Kerberos, the SSH client may attempt to initiate a GSSAPI exchange. If the client cannot contact a Key Distribution Center (KDC), the process hangs. You can mitigate this by disabling GSSAPI authentication on either the client or the server side. On the Windows 11 client, you can often control this behavior via the SSH configuration file if you are using OpenSSH for Windows. Edit or create the file at C:\Users\YourUsername\.ssh\config and add the following lines for your specific host or globally:

Host *
    GSSAPIAuthentication no

Alternatively, you can disable it on the RHEL 9 server by adding GSSAPIAuthentication no to /etc/ssh/sshd_config and restarting the service. This prevents the server from negotiating GSSAPI credentials, forcing it to rely on standard password or public-key methods, which are much faster. It is important to note that disabling these features should only be done if you are certain they are not required for your specific security policies.

Verifying Network and DNS Configuration

While software configuration changes provide quick fixes, ensuring robust network infrastructure is the long-term solution. If you prefer to keep UseDNS enabled for security reasons, you must ensure that your DNS servers have valid PTR records for all client machines. This involves configuring your DHCP server or static IP assignments to include corresponding reverse DNS entries. You can test DNS resolution manually from the RHEL 9 server using the nslookup or dig commands against the Windows 11 client's IP address. If these commands hang or return errors, the issue lies within your DNS infrastructure rather than the SSH configuration. Additionally, check for any firewall rules that might be blocking UDP port 53, which is used for DNS queries. Intermittent packet loss on this port can also cause delays, though less severe than full timeouts. For more details on managing SSH keys and agents, you might find List of ssh keys provided by ssh agent on a remote machine helpful, as proper key management can further streamline the authentication process. Similarly, understanding how to troubleshoot name resolution failures is crucial, as outlined in SSH: Temporary Name Resolution Failure for 'desktop11900'.

Frequently Asked Questions

Does disabling UseDNS compromise SSH security?

It slightly reduces one layer of defense against spoofing attacks, but it does not affect encryption or authentication strength. In most private networks, the risk is minimal compared to the usability gain.

Why does the delay happen even with key-based authentication?

The reverse DNS lookup occurs during the connection setup phase, before authentication begins. Therefore, whether you use passwords or keys, the server still performs the DNS check first.

Can I fix this on the Windows 11 side only?

You can disable GSSAPI on the client, which helps if GSSAPI is the cause. However, if the delay is due to reverse DNS, the fix must be applied on the RHEL 9 server.

What if I don't have root access on the RHEL 9 server?

If you cannot modify sshd_config, you may need to contact your system administrator. Alternatively, you can try using the -o GSSAPIAuthentication=no flag in your SSH command to rule out GSSAPI issues.

How can I verify if UseDNS is causing the delay?

Run ssh -v user@host on the Windows 11 machine. Look for lines indicating "Trying reverse name lookup" or delays between connection establishment and authentication prompts.