Red Hat Bugzilla – Bug 1488982
GSSAPIStrictAcceptorCheck default change with 7.4
Last modified: 2018-04-10 14:20:29 EDT
Description of problem: With the 7.4 release of openssh, the "GSSAPIStrictAcceptorCheck" configuration option default state changed. # rpm -q openssh && sshd -T | grep -i GSSAPIStrictAcceptorCheck openssh-6.6.1p1-35.el7_3.x86_64 gssapistrictacceptorcheck yes Versus: # rpm -q openssh && sshd -T | grep -i GSSAPIStrictAcceptorCheck openssh-7.4p1-12.el7_4.x86_64 gssapistrictacceptorcheck no This causes incomplete Kerberos configured environments to exhibit unexpected failure states. Such as the following where the server side is not properly configured for the Kerberos domain: # ssh -v host.example.com <snip> debug1: Enabling compatibility mode for protocol 2.0^M debug1: Local version string SSH-2.0-OpenSSH_7.4^M debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4^M debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000^M debug1: Authenticating to host.example.com:22 as 'root'^M debug1: Offering GSSAPI proposal: gss-gex-sha1-toWM5Slw5Ew8Mqkay+al2g==,gss-group1-sha1-toWM5Slw5Ew8Mqkay+al2g==,gss-group14-sha1-toWM5Slw5Ew8Mqkay+al2g==,gss-gex-sha1-eipGX3TCiQSrx573bT1o1Q==,gss-group1-sha1-eipGX3TCiQSrx573bT1o1Q==,gss-group14-sha1-eipGX3TCiQSrx573bT1o1Q==^M debug1: SSH2_MSG_KEXINIT sent^M debug1: SSH2_MSG_KEXINIT received^M debug1: kex: algorithm: gss-gex-sha1-toWM5Slw5Ew8Mqkay+al2g==^M debug1: kex: host key algorithm: ecdsa-sha2-nistp256^M debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none^M debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none^M debug1: kex: gss-gex-sha1-toWM5Slw5Ew8Mqkay+al2g== need=64 dh_need=64^M debug1: kex: gss-gex-sha1-toWM5Slw5Ew8Mqkay+al2g== need=64 dh_need=64^M debug1: Doing group exchange ^M debug1: Calling gss_init_sec_context^M debug1: Delegating credentials^M ssh_packet_read: Connection closed^M Version-Release number of selected component (if applicable): openssh-7.4p1-11.el7 and above How reproducible: Simple Steps to Reproduce: 1. Deploy openssh-server from 7.3 such as openssh-6.6.1p1-35.el7_3.x86_64 2. sshd -T | grep gssapistrictacceptorcheck 3. Update to openssh-server from 7.4 such as openssh-7.4p1-11.el7 or above Actual results: gssapistrictacceptorcheck no Expected results: gssapistrictacceptorcheck yes Additional info:
Created attachment 1322712 [details] Patch to revert back to the previous default state
sigh ... there was a bug in upstream that the documentation was saying default is "yes", though it was not in the code. It is fixed in master and even in openssh-7.5, but not in 7.4, which we picked up (and missed). https://github.com/openssh/openssh-portable/commit/13bd2e2 So your patch is something that will actually appear in 7.5 for sure and in Z-stream if we will get it approved. Thanks for the investigation, ideas and testing.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2018:0980