#1147100 openssh-server: SSH login delay caused by LLMNR lookup of “UNKNOWN” client hostname

Package:
openssh-server
Source:
openssh-server
Description:
secure shell (SSH) server, for secure access from remote machines
Submitter:
Carl Winbäck
Date:
2026-09-07 15:57:02 UTC
Severity:
normal
Tags:
#1147100#5
Date:
2026-09-07 15:43:54 UTC
From:
To:
Dear Maintainer,

Please review this bug.


## SUMMARY ##

In some configurations, interactive SSH login has a noticeable delay.


## BACKGROUND ##

I encountered the bug when running Debian in a VM that’s managed by a VM manager
called Lima.

When connecting to the VM, for example using the command `limactl shell
<vm-name>`, there is a delay of about four seconds before the shell becomes
available.

The bug is fixed upstream[0]. I ran a test on Debian unstable[1], and the bug
isn’t present there (openssh-server 10.4p1-4).

See below for further details.


## HOW TO REPRODUCE THE BUG ##

- Create a new VM like this: limactl create --name=myvm template:debian-13
- Start the VM: limactl start myvm
- Run this command and notice how long it takes to complete:
  ssh -F $HOME/.lima/myvm/ssh.config lima-myvm /usr/bin/true
- Then run almost the same command again, except this time we force
  pseudo-terminal allocation. Notice how long it takes to complete.
  ssh -t -F $HOME/.lima/myvm/ssh.config lima-myvm /usr/bin/true

### What I expected to happen ###

That both commands would finish instantly.

### What actually happens ###

The first command (no pseudo-terminal) finishes instantly. The second command,
where the pseudo-terminal is allocated, has a quite significant delay before
completing. On my system it takes about four seconds to complete.


## WHY THE DELAY OCCURS ##

Please see the issue that I filed in Lima’s GitHub project, I have shared my
analysis there[2]. If desirable, I can re-post it here on the list.

Summary: Attempting to resolve the single-lable DNS name `UNKNOWN` is
unsuccessful and causes a four-second delay.


## WORKAROUNDS ##

I have found two feasible workarounds. One way is to add an entry to /etc/hosts,
like this:

```
127.0.0.1 UNKNOWN
::1 UNKNOWN
```

The other option is to modify the file
/etc/systemd/resolved.conf.d/00-lima-enable-mdns.conf, like this:

```
[Resolve]
MulticastDNS=yes
LLMNR=no
```


## REFERENCES ##

[0] Upstream commit that fixes the bug:
https://github.com/openssh/openssh-portable/commit/e5055ef26abc

[1] Image used when testing with Debian unstable:
https://cloud.debian.org/images/cloud/sid/daily/20260805-2561/debian-sid-genericcloud-arm64-daily-20260805-2561.qcow2

[2] Analysis of the bug:
https://github.com/lima-vm/lima/issues/5389#issuecomment-5219820915