search

minishift / minishift-centos-iso

CentOS based ISO as an alternative for boot2docker ISO
GNU Lesser General Public License v3.0
40 stars 33 forks source link

Default UseDNS should be "no" in sshd_config #267

Closed qjcg closed 5 years ago

qjcg commented 5 years ago

Running minishift start when using the minishift CentOS ISO is glacially slow (~10 minute) on my system (current Arch Linux, x86_64 ; ThinkPad T460s), as timeouts for unnecessary DNS lookups must fully elapse at several points during the "start" process. In the context of the host-only network configuration of the minishift VM, the current default setting (UseDNS yes) provides no clear security benefit.

For context, the description of the UseDNS setting in sshd_config(5) is:

UseDNS  Specifies whether sshd(8) should look up the remote host name, and to 
check that the resolved host name for the remote IP address maps back to the 
very same IP address.

If this option is set to no (the default) then only addresses and not host names 
may be used in ~/.ssh/authorized_keys from and sshd_config Match Host directives.

A partial workaround is to run the following in a separate terminal window after having kicked off minishift start each time.

minishift ssh
sudo sed -i 's/#UseDNS yes/UseDNS no/' /etc/ssh/sshd_config
sudo systemctl reload sshd
exit

Discussions of related issues with UseDNS can be reviewed here and here.

qjcg commented 5 years ago

Update --- using the latest minishift (v1.31.0+cfc599c1) & openshift (3.11) versions, I'm no longer getting the slow startup behavior (minishift start now takes a more reasonable 3m30s to complete).

Closing the issue as I can no longer reproduce the problem.