5

I have used Kerberos GSSAPI authentication together with SSH to connect from my Mac to work servers. However, ever since the macOS Sierra upgrade, I'm forced to enter passwords again.

My ~/.ssh/config looks like this:

Host MYSERVER
    GSSAPIAuthentication yes
    GSSAPIDelegateCredentials yes

I originally had there GSSAPITrustDns yes as well, but after the Sierra upgrade, SSH refused to start up saying that it could not parse the config. Removing the line fixed that.

Is there any way to get this working again?

Improve this question
9
  • Is there anything suspicious in the verbose output?
    – PVitt
    Oct 12, 2016 at 9:56
  • I found this in -vvv output. See for yourself: pastebin.com/WPcRba7d
    – Petr Mánek
    Oct 12, 2016 at 11:55
  • I'm sorry, but I can't provide any help on that. But this Server (MYSERVER) unknown looks somewhat suspicious.
    – PVitt
    Oct 12, 2016 at 15:40
  • It does not look like complete log. Removing the GSSAPITrustDns makes some difference according to the documentation. How do you connect to the server? Do you use whole hostname?
    – Jakuje
    Oct 12, 2016 at 18:58
  • 1
    Possible duplicate of SSH No Longer Working After Sierra Update
    – Jakuje
    Nov 7, 2016 at 8:16

3 Answers 3

Reset to default
6

I asked this in the SSH mailing list openssh-unix-dev@mindrot.org and I got this answer:

The GSSAPITrustDNS was never part of portable OpenSSH. This option originally comes from third party extending kerberos support in OpenSSH, which is no longer maintained, but can be simply rebased on the current sources.

The problem in this case is Apple dropping this patch used by many people, so the Apple is the place where you should ask (or your OpenSSH packager of your favorite repository).

http://marc.info/?l=openssh-unix-dev&m=147850754710753&w=2

It seems that we have to ask apple to put this feature back.

Improve this answer
3
  • Thanks, that's actually quite helpful. So, what's in your opinion the best way to get Apple involved? RADAR or some of their customer / dev forums?
    – Petr Mánek
    Nov 10, 2016 at 0:00
  • Hi, sorry, I did not see your message. I did use a forum in here discussions.apple.com/thread/7738793 but apparently we cannot contact apple from there, it is just a user to user thing. As the others say we can file a bug report. However I haven't done it yet, I have been lazy and busy. Some one else can do it and share the results here.
    – acampove
    Nov 24, 2016 at 14:49
  • Or install your own copy of openssh stackoverflow.com/a/46454141/32453
    – rogerdpack
    Sep 27, 2017 at 20:43
1

Apparently apple used to apply some GSSAPI patches to their openssh version, but have recently stopped doing it. Fix: build your own with the patches: https://stackoverflow.com/a/46454141/32453

Improve this answer
-1

DSA Keys are not secure anymore and you need replace them with RSA keys.

Generate new RSA Keys

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

You can refer more detailed steps here

https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/

Improve this answer
1
  • I'm aware of that. However, afaik Kerberos tickets do not use DSA.
    – Petr Mánek
    Oct 12, 2016 at 11:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .