If theres any question ssh to a host at work and then in another window run this: klist klist: krb5ccgetprincipal: No credentials cache file found or klist bash: klist: command not found means you probably arent using kerberos for ssh logins or youd see the host tickets in the output of that command.

Modifying an option in the configuration files fixes this injustice.

Another solution is to add the IP addresses youre going to connect to (or which are going to connect to your mac) in etchosts.

I use ssh frequently for application deployment, maintenance, and git SCM, so this will really speed up my workflow.

Actually, it should be like that by default: GSSAPIKeyExchange Specifies whether key exchange based on GSSAPI is allowed.

GSSAPI key exchange doesnt rely on ssh keys to verify host identity.

The default is no.

Note that this option applies to protocol version 2 only.

The GSSAPI stuff is a good thing long term, which is why it was enabled by default -- make sure the sshd on the servers your connecting to is up to date.

If these are beyond your control, these config changes will help, but know what youre giving up.

Could you please give us more details about good thing long term and what were giving up.

Eventually (sometimes after as much as 10 minutes) I would be connected.

I also noticed that X11 was loading all the time, and I couldnt see what app would be causing it.

The solution was to open the network preferences and set the DNS name servers to those provided by the ISP.

I had been using the router as the dns resolver but Lion seems to have some problems with that.

It required no changes to sshdconfig and youre better off leaving the defaults alone unless you specifically require a non-standard setting.

In my case it was due to ssh trying to do ipv6 negotiation, which apparently fails after a timeout.

The cure was to set the following value in etcsshconfig: AddressFamily inet (You can set it in.sshconfig as well.).

It avoids all the knownhosts bother, but requires that you setup either kerberos or active directory and then get the linux boxes that you are trying to ssh into joined to the kerberos real active directory domain.

That is typically more of a PITA than most IT admins are willing to go through so nearly everywhere you can turn off the GSSAPI-related options in your sshconfig and itll be fine.

The only way that you might want this is if your work actually has the servers that you are sshing to joined to a domain and setup properly to do key exchange.

And its relatively new enough that even at the two kerberos infrastructures that Ive maintained I didnt have servers that supported it, so I couldnt get rid of ssh host key management.

Anyway, ask your IT guys at work about it, and in the 99 case when they do dog-tilt-head and look at you like youre speaking a foreign language to them, you can safely turn this off with precisely zero impact to security.

If you happen to work someplace that does decent IT and has very strong kerberos and security knowledge (say, Morgan Stanley) then you would not want to do this.

Youd also know because your mac laptop would need to be joined to a domainrealm or you would need to auth to the domain to get a TGT in order to authenticate the hosts.

How Fix Ssh Problem For Os X