Problem statement
What should I change first when SSH login on CentOS 7 takes too long before the password prompt appears?
Start by disabling UseDNS and GSSAPIAuthentication in sshd_config, because those are the two most common sources of login delay on older CentOS 7 hosts. If the host also has broken or slow IPv6 reachability, pinning AddressFamily inet can remove another common wait state.
Treat this as a safe first-pass optimization before looking at PAM, fail2ban, auth logs, or network path issues. The goal is to eliminate the common daemon-side stalls first.
In practice, this question often appears on inherited machines where package sources are already old, DNS records are messy, and the team only needs the host stable enough for maintenance, backup, or migration. That is exactly the kind of host where a controlled one-shot SSH tuning script is useful.
What to check
- Turn off reverse DNS lookup with UseDNS no.
- Disable unused Kerberos/GSSAPI auth with GSSAPIAuthentication no.
- Use AddressFamily inet when IPv6 fallback is hurting login latency.
- Keep an existing SSH session open while testing the restart.
Parent topic
Keep legacy CentOS 7 hosts installable and maintainable when yum repositories fail, mirrors expire, or Docker data needs to be moved off a crowded disk.