Bug 713964

Summary: Please document very useful SSH configuration that affects IPA deployments
Product: Red Hat Enterprise Linux 6 Reporter: Simo Sorce <ssorce>
Component: doc-Identity_Management_GuideAssignee: Deon Ballard <dlackey>
Status: CLOSED CURRENTRELEASE QA Contact: ecs-bugs
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 6.2CC: jskeoch, myllynen
Target Milestone: rcKeywords: Documentation
Target Release: 6.2   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-12-12 19:16:17 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Simo Sorce 2011-06-16 22:20:01 UTC 
In some deployments, where bad reverse DNS address are present, logging in using SSH and GSSAPI in an IPA installation may fail due to reverse lookups returning bad information and making SSH fail to pass the right name to the GSSAPI library.

In order to mitigate this issue administrators can set:
GSSAPITrustDNS = no in their /etc/ssh/ssh_config files on clients.

This prevents SSH from using reverse lookups and passes to libgssapi directly the name presented by the user. This in turn allow libgssapi to properly obtain a service ticket to access the target machine.

This should be a documented configuration step for ipa clients as it resolves situations where GSSAPI would be unusable otherwise.
Comment 2 Deon Ballard 2011-08-25 18:30:55 UTC 
I added this to the troubleshooting section in the kerberos chapter:

http://documentation-stage.bne.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/96.2/html/Enterprise_Identity_Management_Guide/Kerberos_Errors.html