similar to: [Bug 1008] GSSAPI authentication fails with Round Robin DNS hosts

https://bugzilla.mindrot.org/show_bug.cgi?id=1008 --- Comment #17 from Darren Tucker <dtucker at zip.com.au> --- (In reply to kgizdov from comment #16) > I hope this helps. Not really. Those have a lot of other changes (mostly the GSSAPI key exchange support) and it still uses get_canonical_hostname() which is currently not available in the client. According to Damien reasoning

https://bugzilla.mindrot.org/show_bug.cgi?id=1008 --- Comment #14 from Mike Frysinger <vapier at gentoo.org> --- (In reply to Darren Tucker from comment #13) the original patch written in 2006 was against openbsd cvs, and it included a config option to turn it on/off (with the default being off). it largely applied cleanly up through 7.2 until the get_canonical_hostname refactor. since

https://bugzilla.mindrot.org/show_bug.cgi?id=1008 Darren Tucker <dtucker at zip.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dtucker at zip.com.au --- Comment #13 from Darren Tucker <dtucker at zip.com.au> --- well it was never

https://bugzilla.mindrot.org/show_bug.cgi?id=1256 Colin Watson <cjwatson at debian.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |cjwatson at debian.org --- Comment #7 from Colin Watson <cjwatson at debian.org> --- It looks as though

http://bugzilla.mindrot.org/show_bug.cgi?id=1008 simon at sxw.org.uk changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |simon at sxw.org.uk ------- Comment #5 from simon at sxw.org.uk 2006-08-19 08:28 ------- There isn't an easy fix for this, at

http://bugzilla.mindrot.org/show_bug.cgi?id=1008 ------- Additional Comments From dleonard at vintela.com 2005-06-08 22:16 ------- a workaround at http://blog.macnews.de/unspecific/stories/4581/ ------- You are receiving this mail because: ------- You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=1008 ------- Comment #7 from jan.iven at cern.ch 2006-10-24 02:17 ------- Created an attachment (id=1202) --> (http://bugzilla.mindrot.org/attachment.cgi?id=1202&action=view) (simplified patch - no config option) Given that the GSSAPI library will (unconditionally) use DNS anyway, perhaps we don't need yet another client-side config

http://bugzilla.mindrot.org/show_bug.cgi?id=1008 --- Comment #9 from Simon Wilkinson <simon at sxw.org.uk> 2007-09-15 20:59:25 --- I've noted this on the mailing list too, but just for the record, the simplified patch is incorrect. GSSAPI != Kerberos, and even within the Kerberos space, some vendors ship with canonicalisation disabled. If we are going to ship a workaround for

https://bugzilla.mindrot.org/show_bug.cgi?id=1008 DarioP <pellegrini.dario at gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |pellegrini.dario at gmail.com --- Comment #11 from DarioP <pellegrini.dario at gmail.com> --- (In reply to

https://bugzilla.mindrot.org/show_bug.cgi?id=1008 kgizdov <mindrot at kge.pw> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mindrot at kge.pw --- Comment #12 from kgizdov <mindrot at kge.pw> --- I just wanted to chime in here to say that

https://bugzilla.mindrot.org/show_bug.cgi?id=1008 --- Comment #16 from kgizdov <mindrot at kge.pw> --- Apparently, some good Samaritan already made patches compatible with the current version of OpenSSH. There is a package on the Arch User Repo (openssh-gssapi 7.1p2-1) that implements them. Here are the patches themselves:

https://bugzilla.mindrot.org/show_bug.cgi?id=1008 Eitan Adler <lists at eitanadler.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lists at eitanadler.com -- You are receiving this mail because: You are the assignee for the bug. You are

https://bugzilla.mindrot.org/show_bug.cgi?id=1008 --- Comment #20 from Christoph Anton Mitterer <calestyo at scientia.org> --- I think this was answered last year in this thread: https://lists.mindrot.org/pipermail/openssh-unix-dev/2022-May/040285.html and unfortunately it seems there won't be any merging of the GSSAPI patch. :-( There's:

https://bugzilla.mindrot.org/show_bug.cgi?id=1008 Oliver Freyermuth <o.freyermuth at googlemail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |o.freyermuth at googlemail.com --- Comment #19 from Oliver Freyermuth <o.freyermuth at

http://bugzilla.mindrot.org/show_bug.cgi?id=1008 Summary: GSSAPI authentication failes with Round Robin DNS hosts Product: Portable OpenSSH Version: -current Platform: All OS/Version: All Status: NEW Severity: normal Priority: P2 Component: Kerberos support AssignedTo: openssh-bugs at mindrot.org

The Kerberos V support may still fail on hosts with two or more interfaces. Regards Markus -------------- next part -------------- *** auth-krb5.c.orig Mon May 20 11:51:57 2002 --- auth-krb5.c Mon May 20 11:53:34 2002 *************** *** 38,43 **** --- 38,44 ---- #include "servconf.h" #include "uidswap.h" #include "auth.h" + #include "canohost.h"

I'm not sure if this is useful to anyone, but I made a small patch to include the local IP address that the user connected to in the environment (the opposite of SSH_CLIENT). The variable is called SSH_LOCAL. -Eric -------------- next part -------------- *** openssh-2.9.9p2/canohost.c.bak Sun Jun 24 22:01:24 2001 --- openssh-2.9.9p2/canohost.c Fri Oct 12 16:52:09 2001 *************** ***

https://bugzilla.mindrot.org/show_bug.cgi?id=626 Colin Watson <cjwatson at debian.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |cjwatson at debian.org --- Comment #3 from Colin Watson <cjwatson at debian.org> --- Isn't this fixed in

I have found the following patches to be desirable for using sshd on a Tru64 UNIX system with the Kerberos 5 SIA module (libsia_krb5.so) from Heimdal. These patches do the following: 1) preserve context between the password authentication and the session setup phases. This is necessary because the Heimdal SIA module stores Kerberos context information as mechanism-specific data in

I have a few patches for AIX. The patchfile is attached below. The patch has been tested on AIX4.2 and AIX4.3. The patch is on openssh-1.2.1pre25, with openssl-0.94, using RSAref. 1) authenticate support - this function allows the system to determine authentification. Whatever the system allows for login, authenticate will too. It doesn't matter whether it is AFS, DFS, SecureID, local.