Bug 2151383
| Summary: | sss_ssh_knownhostsproxy causes high latency with X11 forwarding | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Chance Callahan <ccallaha> |
| Component: | sssd | Assignee: | Alexey Tikhonov <atikhono> |
| Status: | CLOSED WONTFIX | QA Contact: | Anuj Borah <aborah> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 8.6 | CC: | aboscatt, atikhono, dchen, pbrezina, sgadekar |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | sync-to-jira | ||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-06-13 16:36:32 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Chance Callahan
2022-12-06 22:25:30 UTC
Probably performance of `sss_ssh_knownhostsproxy :: proxy_data()` could be improved using something like `sendfile()` (or other zero-copy technique (MSG_ZEROCOPY?)) But not sure if it's worth the effort taking into account `sss_ssh_knownhostsproxy` is deprecated and will be removed / needs to be replaced by `KnownHostsCommand` - see https://github.com/SSSD/sssd/issues/5518 (In reply to Alexey Tikhonov from comment #1) > > But not sure if it's worth the effort taking into account > `sss_ssh_knownhostsproxy` is deprecated A note: I didn't mean "oficially deprecated here". I merely meant "have to be replaced by `KnownHostsCommand`". Well, an attempt to improve performance of SSSD proxy helper - https://github.com/SSSD/sssd/pull/6757 - didn't help a real user. No further attempt will be made to improve it. Instead team will focus on implementing support of new ssh configuration option - `KnownHostsCommand`, that should be much more promising area to put effort into (see https://github.com/SSSD/sssd/issues/5518 ) The behaviour of sss_ssh_knownhostsproxy is: 1. Query IdM server and get the host public key 2. Store the publickey to /var/lib/sss/pubconf/known_hosts So if 1 is slow, patching one SSSD side probably will not help much. Let time how long does it require to get the public key ~~~ time ssh_ssh_knownhostproxy -k -p $PORT $HOST_NAME ~~~ (In reply to Ding-Yi Chen from comment #11) > The behaviour of sss_ssh_knownhostsproxy is: > > 1. Query IdM server and get the host public key > 2. Store the publickey to /var/lib/sss/pubconf/known_hosts > > So if 1 is slow, patching one SSSD side probably will not help much. What is slow is: 3. proxy data: https://github.com/SSSD/sssd/blob/34ef9c5f3e90d5c50c7ac5161c39daa2840c92f2/src/sss_client/ssh/sss_ssh_knownhostsproxy.c#L77 |