Bug 1702

Summary: PreferredAuthentications setting doesn't work when spaces are used as documented
Product: Portable OpenSSH Reporter: Venkat Yekkirala <ysvenkat>
Component: sshAssignee: Assigned to nobody <unassigned-bugs>
Status: CLOSED FIXED    
Severity: normal CC: dtucker, jbasney, ysvenkat
Priority: P2    
Version: 5.3p1   
Hardware: Other   
OS: Mac OS X   
Bug Depends on:    
Bug Blocks: 1743    
Attachments:
Description Flags
/tmp/ssh-preferredauth-man.patch none

Description Venkat Yekkirala 2010-01-22 05:04:27 AEDT 
The man page ssh_config.5 specifies the default setting for PreferredAuthentications as:
"gssapi-with-mic, hostbased, publickey, keyboard-interactive, password"
with a space after each comma.

But when I set PreferredAuthentications in ssh_config as follows:
PreferredAuthentications "gssapi-keyex, gssapi-with-mic, publickey, hostbased, password"
with a space after each comma, ssh fails to process authentication methods beyond the first one in the list. It will however work as expected if the spaces are removed.

Either the man page or code (match_list()?) needs to be fixed.

Below is the debug log of the failure:

debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
debug3: preferred gssapi-keyex, gssapi-with-mic, publickey, hostbased, password
debug3: authmethod_lookup gssapi-keyex
debug3: remaining preferred:  gssapi-with-mic, publickey, hostbased, password
debug3: authmethod_is_enabled gssapi-keyex
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive).
Comment 1 Darren Tucker 2010-03-26 11:40:26 AEDT 
This is a problem with the man page formatting.  I'll attach a patch.
Comment 2 Darren Tucker 2010-03-26 11:43:38 AEDT 
Created attachment 1823 [details]
/tmp/ssh-preferredauth-man.patch

Format default value of PreferredAuthentication to match reality.
Comment 3 Darren Tucker 2010-03-26 12:10:01 AEDT 
Patch has been applied and will be in 5.5p1.  Thanks for the report.
Comment 4 Damien Miller 2010-04-16 15:49:36 AEST 
Mass move of bugs RESOLVED->CLOSED following the release of openssh-5.5p1