Bug 1749862

Summary:	GSSAPITrustDNS fails on proxy hosts causing gssapi authentication failures
Product:	Red Hat Enterprise Linux 8	Reporter:	Oliver Ilian <oliver>
Component:	openssh	Assignee:	Jakub Jelen <jjelen>
Status:	CLOSED ERRATA	QA Contact:	Ondrej Moriš <omoris>
Severity:	high	Docs Contact:
Priority:	medium
Version:	8.1	CC:	cheimes, omoris, ssorce, szidek, tmraz
Target Milestone:	rc	Keywords:	Regression, Triaged
Target Release:	8.0	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openssh-8.0p1-5.el8	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-11-04 01:31:59 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Oliver Ilian 2019-09-06 15:24:25 UTC

Description of problem:
After upgrading from openssh-7.8p1-4.el8.x86_64 to openssh-8.0p1-3.el8, my GSSAPIDelegateCredentials is no longer working. The server is asking for a password to log in, while on 7.8, it just logs me in.

Version-Release number of selected component (if applicable):
RHEL 8.1
openssh-8.0p1-3.el8

How reproducible:
always

Steps to Reproduce:
1. upgrade openssh from 7.8p1-4.el8 to 8.0p1-3.el8
2. try to ssh into a server that was previously using GSSAPI auth to log you in

Actual results:
user is asked for a password when using ssh

Expected results:
user should just be logged in

Comment 1 Jakub Jelen 2019-09-10 09:59:11 UTC

The option `GSSAPIDelegateCredentials` does not do anything with authentication. It would just forward your kerberos credentials to the server after you would get authenticated using GSSAPIAuthentication or GSSAPIKeyExchange. Can you share debug logs from the old working and new non-working setups? And optionally also your client and configurations?

Comment 22 errata-xmlrpc 2020-11-04 01:31:59 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (openssh bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:4439

Comment 23 Red Hat Bugzilla 2023-09-14 05:42:56 UTC

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days