5

I have used Kerberos GSSAPI authentication together with SSH to connect from my Mac to work servers. However, ever since the macOS Sierra upgrade, I'm forced to enter passwords again.

My ~/.ssh/config looks like this:

Host MYSERVER
    GSSAPIAuthentication yes
    GSSAPIDelegateCredentials yes

I originally had there GSSAPITrustDns yes as well, but after the Sierra upgrade, SSH refused to start up saying that it could not parse the config. Removing the line fixed that.

Is there any way to get this working again?

  • Is there anything suspicious in the verbose output? – PVitt Oct 12 '16 at 9:56
  • I found this in -vvv output. See for yourself: pastebin.com/WPcRba7d – Petr Mánek Oct 12 '16 at 11:55
  • I'm sorry, but I can't provide any help on that. But this Server (MYSERVER) unknown looks somewhat suspicious. – PVitt Oct 12 '16 at 15:40
  • It does not look like complete log. Removing the GSSAPITrustDns makes some difference according to the documentation. How do you connect to the server? Do you use whole hostname? – Jakuje Oct 12 '16 at 18:58
  • 1
    Possible duplicate of SSH No Longer Working After Sierra Update – Jakuje Nov 7 '16 at 8:16
6

I asked this in the SSH mailing list openssh-unix-dev@mindrot.org and I got this answer:

The GSSAPITrustDNS was never part of portable OpenSSH. This option originally comes from third party extending kerberos support in OpenSSH, which is no longer maintained, but can be simply rebased on the current sources.

The problem in this case is Apple dropping this patch used by many people, so the Apple is the place where you should ask (or your OpenSSH packager of your favorite repository).

http://marc.info/?l=openssh-unix-dev&m=147850754710753&w=2

It seems that we have to ask apple to put this feature back.

  • Thanks, that's actually quite helpful. So, what's in your opinion the best way to get Apple involved? RADAR or some of their customer / dev forums? – Petr Mánek Nov 10 '16 at 0:00
  • Hi, sorry, I did not see your message. I did use a forum in here discussions.apple.com/thread/7738793 but apparently we cannot contact apple from there, it is just a user to user thing. As the others say we can file a bug report. However I haven't done it yet, I have been lazy and busy. Some one else can do it and share the results here. – acampove Nov 24 '16 at 14:49
  • Or install your own copy of openssh stackoverflow.com/a/46454141/32453 – rogerdpack Sep 27 '17 at 20:43
1

Apparently apple used to apply some GSSAPI patches to their openssh version, but have recently stopped doing it. Fix: build your own with the patches: https://stackoverflow.com/a/46454141/32453

-1

DSA Keys are not secure anymore and you need replace them with RSA keys.

Generate new RSA Keys

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

You can refer more detailed steps here

https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/

  • I'm aware of that. However, afaik Kerberos tickets do not use DSA. – Petr Mánek Oct 12 '16 at 11:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .