#1003244 openssh-client: ssh_config manpage has conflicting information about Debian-specific changes to defaults

Package:
openssh-client
Source:
openssh
Description:
secure shell (SSH) client, for secure access to remote machines
Submitter:
Peter van Dijk
Date:
2022-01-06 22:12:03 UTC
Severity:
normal
#1003244#5
Date:
2022-01-06 22:04:01 UTC
From:
To:
Dear Maintainer,

   * What led up to the situation?

After upgrading to Debian 11, using ssh to connect to one of my machines took a very long time.
The time is spent in:

debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000)

This happens twice and takes a total of around 100 seconds. The first few tries I figured my VM had
half-died because ssh just sat there.

After a while I figured out disabling GSSAPIAuthentication helped. But the manpage is confusing.

ssh_config(5) says:

     GSSAPIAuthentication
             Specifies whether user authentication based on GSSAPI is allowed.  The default is no.

it also says:

     Note that the Debian openssh-client package sets several options as standard in
     /etc/ssh/ssh_config which are not the default in ssh(1):

           o   Include /etc/ssh/ssh_config.d/*.conf
           o   SendEnv LANG LC_*
           o   HashKnownHosts yes
           o   GSSAPIAuthentication yes

but I usually search manpages, not read them end to end. So, the bit about Debian defaults being different is very hard to miss. Perhaps the sections on those four options could grow a few words repeating the changes that Debian did.
#1003244#10
Date:
2022-01-06 22:10:04 UTC
From:
To:
Oops. It is very -easy- to miss, of course.