System maintenance

optimize_centos7_ssh.sh

Designed for legacy CentOS 7 hosts where SSH login is slow because the daemon waits on reverse DNS lookup, GSSAPI negotiation, or IPv6 fallback. The script backs up sshd_config, enforces the recommended settings, validates the syntax, and then restarts sshd.

One-liner

curl -fL 'https://www.helper.sh/optimize_centos7_ssh.sh' -o './optimize_centos7_ssh.sh'

This command downloads the bundled file only; it does not run it. Inspect the saved source and compare its version before deciding whether to execute it.

Raw file

Download script for review Raw script

Bundled in this site

Check the file you downloaded

Compare a saved file with the exact bytes bundled in this page’s build. The file stays in this tab; this tool does not upload or persist it. Maximum 2 MiB.

Expected SHA-256
83286133883b50a41d5a144397e9d4d380e14f8a0e3bf25be90348b92d678c53

Bundled byte count: 1589

Save checksum file

Save the script and checksum in the same directory. On Linux with GNU Coreutils, the command below checks the saved bytes only; it does not run the script. Keep the original filename for this command.

sha256sum --check './optimize_centos7_ssh.sh.sha256'

No comparison yet.

Selected file SHA-256

The checksum and script come from the same site, not an independent signature. A match does not prove safety, authenticity of upstream dependencies, or suitability for your host. Mutable remote dependencies need separate review.

Read validation and limitations

Requirements

CentOS 7 or similar OpenSSH host
root privileges or sudo
/etc/ssh/sshd_config present
systemctl or service command

Best for

Shorten slow SSH login caused by reverse DNS lookup
Disable GSSAPI auth on hosts that do not use Kerberos
Standardize SSH latency tuning during CentOS 7 maintenance

Highlights

Creates a timestamped backup before editing sshd_config
Sets UseDNS no, GSSAPIAuthentication no, and AddressFamily inet idempotently
Runs sshd -t before restart so bad config does not get applied blindly

Recommended procedure

Fetch the script from helper.sh with curl.
Run it as root or through sudo.
Let the script back up, update, validate, and restart sshd.
Reconnect with SSH and confirm the login delay is gone.

Safety notes

Review the raw script first if the host is production-critical.
If the server depends on Kerberos or IPv6-only connectivity, do not apply these defaults blindly.
Keep an existing SSH session open while testing the restart.

Compatibility and limits

This is a legacy CentOS 7 maintenance aid; CentOS 7 is end of life and this is not a long-term platform recommendation.
Requires root, /etc/ssh/sshd_config, sshd -t, and either systemctl or service. It has no user parameters, dry-run, or automatic rollback. The script edits this one file and does not inspect included configuration files.
AddressFamily inet makes sshd listen on IPv4 only. GSSAPIAuthentication no disables GSSAPI/Kerberos SSH authentication; do not apply if clients or policy depend on either. UseDNS no disables reverse lookup; OpenSSH documents that with this setting host names cannot be used in authorized_keys from or sshd_config Match Host directives.

Files, services, and data affected

/etc/ssh/sshd_config: creates or replaces UseDNS, GSSAPIAuthentication, and AddressFamily directives; makes a timestamped copy before editing.
Restarts the sshd service after `sshd -t` succeeds. No ports or application data are changed.

Read-only verification

Before execution, inspect the effective directives with `sudo sshd -T | grep -E '^(usedns|gssapiauthentication|addressfamily) '`.
After a planned maintenance run, check `sudo sshd -t`, `sudo systemctl status sshd` (or `sudo service sshd status`), then open a new SSH connection over the required address family while keeping the current session open.

If it fails

If sshd -t fails, the script exits but leaves the edited file in place. Keep the current session open, inspect the reported line, and restore the timestamped backup manually if needed. If service restart fails, inspect `sudo journalctl -u sshd -n 100 --no-pager`; do not close the working session.

Reference documentation

The CentOS 7 manual archive is served by a mirror. The current OpenBSD manual is upstream reference material and may differ from the version shipped with CentOS 7.

Download, inspect, then verify the version before execution. A hash only identifies these exact bytes; it does not prove safety. Piped commands run remote content immediately, and upstream dependencies can change.

CentOS 7: choose a recovery task

Separate repository failures, SSH access problems and Docker storage pressure before changing an end-of-life host.

Open topic

Problem pages

Why is CentOS 7 SSH login so slow

The usual causes are reverse DNS lookup, GSSAPI auth negotiation, and sometimes IPv6 fallback. Disable those waits before doing deeper SSH troubleshooting.

Open page