CentOS7.4通过ssh连接到服务器的时候特别慢

1、如果尝试从同网段的其他服务器登录过去也慢，说明该问题可能是服务器本身导致的，而不是网络导致的。那么此时，可以从同网段的其他服务器上：

# ssh -vvv 目标IP地址

目标ip地址就是ssh过去慢的那台服务器的ip地址。

2、通过输出查看卡主在什么地方

debug3: send packet: type 50
debug2: we sent a password packet, wait for reply
debug3: receive packet: type 52
debug1: Authentication succeeded (password).
Authenticated to 10.119.105.144 ([10.119.105.144]:22).
debug1: channel 0: new [client-session]
debug3: ssh_session2_open: channel_new: 0
debug2: channel 0: send open
debug3: send packet: type 90
debug1: Requesting no-more-sessions@openssh.com
debug3: send packet: type 80
debug1: Entering interactive session.
debug1: pledge: network

这个是卡住的地方，卡了20几秒后输出如下：

debug3: receive packet: type 80
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
debug3: receive packet: type 91
debug2: callback start
debug2: fd 3 setting TCP_NODELAY
debug3: ssh_packet_set_tos: set IP_TOS 0x10
debug2: client_session2_setup: id 0
debug2: channel 0: request pty-req confirm 1
debug3: send packet: type 98
debug1: Sending environment.
debug3: Ignored env XDG_SESSION_ID
debug3: Ignored env HOSTNAME
debug3: Ignored env BILL_LOG_PATH
debug3: Ignored env TERM
debug3: Ignored env SHELL
debug3: Ignored env HISTSIZE
debug3: Ignored env SSH_CLIENT
debug3: Ignored env TIME_STYLE
debug3: Ignored env ZXINOS_PATH
debug3: Ignored env IMANAGER_SOURCE
debug3: Ignored env SSH_TTY
debug3: Ignored env JRE_HOME
debug3: Ignored env USER
debug3: Ignored env LD_LIBRARY_PATH
debug3: Ignored env LS_COLORS
debug3: Ignored env QuickMDB_HOME
debug3: Ignored env ORACLE_BASE
debug3: Ignored env IMANAGER_PATH
debug3: Ignored env MAIL
debug3: Ignored env PATH
debug3: Ignored env CCB_INSTANCE_HOME
debug3: Ignored env PWD
debug3: Ignored env JAVA_HOME
debug3: Ignored env ZXLOGSIZE
debug1: Sending env LANG = C
debug2: channel 0: request env confirm 0
debug3: send packet: type 98
debug3: Ignored env PROJECT_DIR
debug3: Ignored env PS1
debug3: Ignored env HISTCONTROL
debug3: Ignored env LIBSSH2_HOME
debug3: Ignored env SHLVL
debug3: Ignored env HOME
debug3: Ignored env LOGNAME
debug3: Ignored env CLASSPATH
debug3: Ignored env SSH_CONNECTION
debug3: Ignored env IMPSYSDIR
debug3: Ignored env LESSOPEN
debug3: Ignored env QuickMDB_LIB
debug3: Ignored env TOOLS_PATH
debug3: Ignored env ZSMART_HOME
debug3: Ignored env XDG_RUNTIME_DIR
debug3: Ignored env ORACLE_HOME
debug3: Ignored env HISTTIMEFORMAT
debug3: Ignored env OLDPWD
debug3: Ignored env _
debug2: channel 0: request shell confirm 1
debug3: send packet: type 98
debug2: callback done
debug2: channel 0: open confirm rwindow 0 rmax 32768
debug3: receive packet: type 99
debug2: channel_input_status_confirm: type 99 id 0
debug2: PTY allocation request accepted on channel 0
debug2: channel 0: rcvd adjust 2097152
debug3: receive packet: type 99
debug2: channel_input_status_confirm: type 99 id 0
debug2: shell request accepted on channel 0
Last login: Thu May 7 22:18:03 2020

https://serverfault.com/questions/792486/ssh-connection-takes-forever-to-initiate-stuck-at-pledge-network

这里有篇文章，卡在debug1: pledge: network一般会有以下几方面的原因：

a、/var/log/btmp文件过大

此问题是由大btmp文件（数百MB）引起的。该文件记录登录尝试。当人们试图强行使用您的密码时，此文件可能很大并且会导致"pledge: network"阶段延迟。对我来说，此问题是由大btmp文件（数百MB）引起的。该文件记录登录尝试。当人们试图强行使用您的密码时，此文件可能很大并且会导致"pledge: network"阶段延迟。如果不想记录错误登陆的错误日志，可以尝试配置/etc/ssh/sshd_config文件中GSSAPIAuthentication=no和UseDNS=no，然后重启sshd服务systemctl restart sshd。

此时我查看了该文件，发现有24G：

-rw------- 1 root utmp 24341866368 May 7 18:55 btmp

此时可以清掉该文件：

# >/var/log/btmp

b、D-Bus and systemd 进程导致的问题

检查/var/log/auth.log日志文件，确认是否有如下的报错：

sshd[2721]: pam_systemd(sshd:session): Failed to create session: Connection timed out

如果有，请重启systemd-logind服务：

systemctl restart systemd-logind

导致该问题的原因是，可能因为 D-Bus 服务因为某种原因重启了，所以导致systemd-logind服务也需要重启。

也可以使用如下命令来查看systemd-logind服务是否有报错。

# journalctl -u systemd-logind.service -r

 c、rsyslogd服务奔溃

如果发现在/ var / log / syslog或/var/log/mail.log中不再有日志消息，则可能是rsyslog进程奔溃了，此时我们只需要重启该服务即可。

# systemctl restart  rsyslog

d、检查如下两个文件

cat /etc/rsyslog.conf
cat /etc/resolv.conf

我这边检查了resolv.conf文件是空的，没有使用dns。

rsyslog.conf内容如下：

#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log


# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList   # run asynchronously
#$ActionResumeRetryCount -1    # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@remote-host:514
# ### end of the forwarding rule ###
# set messages privilege
$umask 0022
$FileCreateMode 0640
authpriv.*                          @10.1xx.1xx.xxx
auth.*                              @10.1xx.1xx.xxx
daemon.*                            @10.1xx.1xx.xxx
ftp.*                               @10.1xx.1xx.xxx
syslog.*                            @10.1xx.1xx.xxx
user.*                              @10.1xx.1xx.xxx
local0.*;local1.*                   @10.1xx.1xx.xxx
local2.*;local3.*                   @10.1xx.1xx.xxx
local4.*;local5.*                   @10.1xx.1xx.xxx
local6.*;local7.*                   @10.1xx.1xx.xxx

目测也没啥问题。 

e、检查如下日志文件

/var/log/wtmp
/var/log/utmp

如果过大，则清掉。

f、如果在主机其他方面没有什么异常的情况下，突然从某天开始ssh登陆就很慢，最简单的办法，上来先看日志：

# cd /var/log/

# ls -l

就看哪个日志文件很大，一般上G了基本就有问题，备份后清理掉在试基本能解决问题。