# Disabling reverse dns lookups in ssh **URL:** \ **Category:** Administration\ **Created:** [May 13, 2009, 8:57am UTC](https://linux-tips.com/t/disabling-reverse-dns-lookups-in-ssh/222 "2009-05-13T08:57:27Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![demirten](https://linux-tips.com/user_avatar/linux-tips.com/demirten/32/64_2.png) [@demirten](https://linux-tips.com/u/demirten)\ **Post date:** [May 13, 2009, 8:57am UTC](https://linux-tips.com/t/disabling-reverse-dns-lookups-in-ssh/222/1 "2009-05-13T08:57:27Z")
Sometimes it is very annoying to wait ten’s of seconds to finish remote ssh server’s _reverse dns lookup_ procedure. It can be disabled on the server side but this process has a few tricks. First of all, you have to make “_UseDNS no_” in `/etc/ssh/sshd_config` file, default answer is _yes_ and if this line not exists in your config file, just add it to as below: ``` UseDNS no ``` This directive tells sshd process to check resolved host name for the connected client’s ip address maps back to the very same ip address or not. However, it does not prevent the sshd server from performing any DNS lookups at all. That’s not the purpose of that directive. In order to remove dns lookups completely, you have to use `-u0` options when starting _sshd_ server. You can easily add this options to `/etc/default/ssh` or `/etc/sysconfig/sshd` or elsewhere suitable for your distribution. `-u0` option’s means that it will not put hostnames into the _utmp_ structure (i.e. what you see when you type “who” at the shell prompt), which means that sshd will not perform any DNS lookups for that purpose. However there are still cases where a lookup has to be performed when a user has ``` from= ``` like entries in his `authorized_keys` file, or when authentication methods or configuration directives are used that involve hostnames. ---
**Author:** ![redsector](https://linux-tips.com/user_avatar/linux-tips.com/redsector/32/71_2.png) [@redsector](https://linux-tips.com/u/redsector)\ **Post date:** [August 4, 2015, 8:09am UTC](https://linux-tips.com/t/disabling-reverse-dns-lookups-in-ssh/222/3 "2015-08-04T08:09:31Z")
We have a ssh connection delay when connecting to our system remotely. Sshd config file already has `UseDNS No` option but it seems that sshd try to make reverse dns resolution. How can I disable ssh reverse dns lookups completely? ---
**Author:** ![DrSlump](https://linux-tips.com/user_avatar/linux-tips.com/drslump/32/61_2.png) [@DrSlump](https://linux-tips.com/u/DrSlump)\ **Post date:** [December 17, 2014, 9:39pm UTC](https://linux-tips.com/t/disabling-reverse-dns-lookups-in-ssh/222/4 "2014-12-17T21:39:40Z")
If you want to disable all type of connection delay, you have to disable `GSSAPIAuthentication` too if active. GSSAPI is a IETF standard for doing strong encrypted authentication in network based applications. It is also supported by openssh but it can also introduce delays. Some distributions left this mode active on default, so you have to change like this in `/etc/ssh/sshd_config`: ``` GSSAPIAuthentication no ``` ---
**Author:** ![John](https://linux-tips.com/letter_avatar_proxy/v4/letter/j/a3d4f5/32.png) [@John](https://linux-tips.com/u/John)\ **Post date:** [September 3, 2016, 7:08am UTC](https://linux-tips.com/t/disabling-reverse-dns-lookups-in-ssh/222/5 "2016-09-03T07:08:10Z")
I like to pass the GSSAPIAuthentication=no option on the command line to prevent this message. Example: ```auto ssh -o GSSAPIAuthentication=no user@hostname.com ``` …or you can just add `GSSAPIAuthentication=no` to /etc/ssh/ssh\_config It may already exist in the file, just change it from yes to no. ---
**Author:** ![fumiyas](https://linux-tips.com/letter_avatar_proxy/v4/letter/f/e95f7d/32.png) [@fumiyas](https://linux-tips.com/u/fumiyas)\ **Post date:** [July 13, 2017, 9:33am UTC](https://linux-tips.com/t/disabling-reverse-dns-lookups-in-ssh/222/6 "2017-07-13T09:33:11Z")
No. `UseDNS no` in `sshd_config` enables equivalent of `sshd -d0` too. I’ve confirmed source codes in OpenSSH 6.6p1, 7.2p1 and 7.5p1. ---
**Author:** ![rory](https://linux-tips.com/letter_avatar_proxy/v4/letter/r/a183cd/32.png) [@rory](https://linux-tips.com/u/rory)\ **Post date:** [April 12, 2018, 3:51pm UTC](https://linux-tips.com/t/disabling-reverse-dns-lookups-in-ssh/222/7 "2018-04-12T15:51:31Z")
As the top Google result for “ssh disable reverse DNS” I thought I’d post this here. TL;DR version: tcp wrappers (libwrap), may be causing a reverse DNS lookup to occur. !(TL;DR) version: A head-shaped dent was beginning to metaphorically appear on the wall, trying everything I could find to ascertain why my ssh initial connection was slow. A bit of running sshd in debug mode along with strace (and subsequently tcpdump), showed that was making repeated attempts to lookup the IP address with a DNS PTR lookup. Watching the process with ltrace, showed me that the hosts\_access library function was being called, and was taking a long time Looking through the openssh source code revealed this to be libwrap related. I didn’t look through the libwrap code (had difficulty finding it, and solved my problem before I did find it), but had the following in my hosts.allow file: `ALL: localhost` It would seem (from my observed behaviour), that when libwrap comes across this, rather than resolving localhost to 127.0.0.1, and comparing that with my IP address, it does a reverse lookup on my ip address, and compares the result with ‘localhost’. This issue was resolved by changing localhost to `127.0.0.1/8, ::1`. ---
**Author:** ![Sean\_Leinen](https://linux-tips.com/user_avatar/linux-tips.com/sean_leinen/32/410_2.png) [@Sean\_Leinen](https://linux-tips.com/u/Sean_Leinen)\ **Post date:** [January 18, 2023, 4:39pm UTC](https://linux-tips.com/t/disabling-reverse-dns-lookups-in-ssh/222/8 "2023-01-18T16:39:22Z")
@fumiyas – he said “-u0” (utmp structure), not “-d0”.