Created attachment 1548 [details] My sshd config file sshd 5.1p1's nifty new configure-dumping mode reports port 22 protocol 2 addressfamily any listenaddress 0.0.0.0:22 listenaddress [::]:22 serverkeybits 1024 logingracetime 600 keyregenerationinterval 3600 x11displayoffset 10 maxauthtries 6 clientaliveinterval 0 clientalivecountmax 3 permitrootlogin yes ignorerhosts yes ignoreuserknownhosts no rhostsrsaauthentication no hostbasedauthentication no hostbasedusesnamefrompacketonly no rsaauthentication yes pubkeyauthentication yes UNKNOWN no UNKNOWN yes UNKNOWN yes UNKNOWN no UNKNOWN no UNKNOWN yes passwordauthentication yes kbdinteractiveauthentication no challengeresponseauthentication no printmotd yes printlastlog yes x11forwarding yes x11uselocalhost yes strictmodes yes tcpkeepalive yes permitemptypasswords no permituserenvironment yes uselogin no compression delayed gatewayports no usedns yes allowtcpforwarding yes useprivilegeseparation yes pidfile /var/run/sshd.pid xauthlocation /usr/bin/xauth authorizedkeysfile .ssh/authorized_keys authorizedkeysfile2 .ssh/authorized_keys2 loglevel INFO syslogfacility AUTH hostkey /etc/openssh/ssh_host_key hostkey /etc/openssh/ssh_host_rsa_key hostkey /etc/openssh/ssh_host_dsa_key acceptenv DISPLAY acceptenv X_ORIGINATING_HOST acceptenv LANG acceptenv LC_* subsystem sftp /usr/libexec/sftp-server maxstartups 10:100:10 permittunnel no permitopen Bringing the UNKNOWNs into greater clarity with a few debugging printf()s (the number is the opcode number, of course): UNKNOWN opcode name(12) no UNKNOWN opcode name(13) yes UNKNOWN opcode name(14) yes UNKNOWN opcode name(15) no UNKNOWN opcode name(59) no UNKNOWN opcode name(60) yes Config attached: the only option that's there that the compiled OpenSSH doesn't understand is UsePAM. (In case it's interesting, this was compiled with GCC 4.3.1.)
The UNKNOWN options seem to be all GSSAPI/Kerberos related. I think they need to be #ifdef'd out when these aren't compiled in.
Created attachment 1549 [details] #ifdef out config dump options based on build-time config Agreed, that's what it is. Please try this patch. I should have had a regress test for this.
Created attachment 1550 [details] do not display disabled options for -T Do not try to print options for facilities that have not been enabled at compile time.
Comment on attachment 1549 [details] #ifdef out config dump options based on build-time config djm's patch is better because it include UsePAM, please try it instead.
Well, if *this* is the most serious bug I've ever seen in OpenSSH (and it is, excepting interaction problems with severely buggy servers), I'm satisfied :) Patch 1550 fixes it for me.
ok, this has been committed and will be in openssh-5.2. Thanks for the report.
*** Bug 1497 has been marked as a duplicate of this bug. ***
Close bugs fixed/reviewed for openssh-5.2 release