Bug 2553 - 7.2p2 on server breaks GSSAPI with older clients
Summary: 7.2p2 on server breaks GSSAPI with older clients
Status: CLOSED INVALID
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: Kerberos support (show other bugs)
Version: 7.2p1
Hardware: amd64 Solaris
: P5 normal
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-03-17 00:58 AEDT by Dan McDonald
Modified: 2016-08-02 10:41 AEST (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Dan McDonald 2016-03-17 00:58:14 AEDT
I put 7.2p2 into OmniOS (an illumos distro... you don't call out illumos yet, so I put it with Solaris for now... you need to fix that) yesterday.  A GSSAPI user has reported that their GSSAPI authentication breaks now.  Apparently I'm not the only one seeing it:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=817870

I've yet to confirm/deny if a 7.2 client works with a 7.2 server.

One possibly relevant client-side-only pastebin:

http://fpaste.org/340879/81335561/
Comment 1 Dan McDonald 2016-03-17 00:59:51 AEDT
I build with these patches:

https://github.com/omniti-labs/omnios-build/tree/master/build/openssh/patches

(And the commit message is a bit wrong - they are updated for 7.2p2.)
Comment 2 Dan McDonald 2016-03-17 01:01:31 AEDT
I build with these patches:

https://github.com/omniti-labs/omnios-build/tree/master/build/openssh/patches

(And the commit message is a bit wrong - they are updated for 7.2p2.)


>>> I've yet to confirm/deny if a 7.2 client works with a 7.2 server.

Confirmed that a 7.2 client works with a 7.2 server.  So perhaps it's a dropped algorithm?
Comment 3 Dan McDonald 2016-03-17 01:05:30 AEDT
Pastebin with successful 7.2 client to 7.2 server session:

http://fpaste.org/340917/13698814/
Comment 4 Damien Miller 2016-03-18 04:58:48 AEDT
This:

debug1: Offering GSSAPI proposal: gss-gex-sha1-toWM5Slw5Ew8Mqkay+al2g==,gss-group1-sha1-toWM5Slw5Ew8Mqkay+al2g==,gss-group14-sha1-toWM5Slw5Ew8Mqkay+al2g==

Isn't OpenSSH. It's a 3rd-party patch that we didn't write and don't maintain. You'll have to look to whoever wrote that patch for support.
Comment 5 Dan McDonald 2016-03-18 06:48:02 AEDT
(In reply to Damien Miller from comment #4)
> This:
> 
> debug1: Offering GSSAPI proposal:
> gss-gex-sha1-toWM5Slw5Ew8Mqkay+al2g==,gss-group1-sha1-
> toWM5Slw5Ew8Mqkay+al2g==,gss-group14-sha1-toWM5Slw5Ew8Mqkay+al2g==
> 
> Isn't OpenSSH. It's a 3rd-party patch that we didn't write and don't
> maintain. You'll have to look to whoever wrote that patch for
> support.

Thank you for the clarification, and sorry for the disturbance.
Comment 6 Damien Miller 2016-08-02 10:41:50 AEST
Close all resolved bugs after 7.3p1 release