Dear Maintainer,

     After system update, command `sss_ssh_knownhostsproxy` is deprecate
by SSSD.
     But the file /etc/ssh/ssh_config.d/04-ipa.conf create by
`ipa-client-install` before 4.12 contain these line.

     /etc/ssh/ssh_config.d/04-ipa.conf create before 4.12
     ```
     # IPA-related configuration changes to ssh_config
     #
     PubkeyAuthentication yes
     # disabled by ipa-client update
     # GlobalKnownHostsFile /var/lib/sss/pubconf/known_hosts
     #VerifyHostKeyDNS yes

     # assumes that if a user does not have shell (/sbin/nologin),
     # this will return nonzero exit code and proxy command will be ignored
     Match exec true
             ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h
     ```

     Therefore, ssh will return error

     ```
******************************************************************************
     Your system is configured to use the obsolete tool
sss_ssh_knownhostsproxy.
     Please read the sss_ssh_knownhosts(1) man page to learn about its
replacement.
******************************************************************************

     Connection closed by UNKNOWN port 65535
     ```

     This file is not contain in freeipa-client, it is create by
`ipa-client-install`.
     So it won't change after update.



     Fix:

     freeipa 4.12 release fix the issue 9536: Client configuration of
ssh: Replace sss_ssh_knownhostsproxy with sss_ssh_knownhosts
     https://www.freeipa.org/release-notes/4-12-0.html
     https://pagure.io/freeipa/issue/9536

     In 4.12 release also include a mechanism to apply change when
upgrading from older versions, and downgrading from newer versions.
     But this mechanism is base on the spec file, a RPM package control
file.
     It "only" work on RPM base system.

     commit a41e5e2a244f8fa2edfd7db1e821d8b0f3bbd997 is the change.
https://pagure.io/freeipa/c/a41e5e2a244f8fa2edfd7db1e821d8b0f3bbd997

     But this change doesn't convert to the DEB control file,
debian/freeipa-client.postinst.

https://salsa.debian.org/freeipa-team/freeipa/-/tree/master/debian
     No freeipa-client.postinst is exist.

     I think these line should be add into
debian/freeipa-client.postinst to fix the problem while package update.

     ```
     if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" =
"abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
         # Has the client been configured?
         restore=0
         test -f '/var/lib/ipa-client/sysrestore/sysrestore.index' &&
restore=$(wc -l '/var/lib/ipa-client/sysrestore/sysrestore.index' | awk
'{print $1}')

         if [ $restore -ge 2 ]; then
             SSH_CLIENT_SYSTEM_CONF="/etc/ssh/ssh_config"
             if [ -f "$SSH_CLIENT_SYSTEM_CONF" ]; then
                 # https://pagure.io/freeipa/issue/9536
                 # replace sss_ssh_knownhostsproxy with sss_ssh_knownhosts
                 if [ -f '/usr/bin/sss_ssh_knownhosts' ]; then
                     if grep -E -q 'Include' $SSH_CLIENT_SYSTEM_CONF 
2>/dev/null ; then
SSH_CLIENT_SYSTEM_CONF="/etc/ssh/ssh_config.d/04-ipa.conf"
                     fi
                     sed -E --in-place=.orig 's/^(GlobalKnownHostsFile
\/var\/lib\/sss\/pubconf\/known_hosts)$/# disabled by ipa-client
update\n# \1/' $SSH_CLIENT_SYSTEM_CONF
                     sed -E --in-place=.orig 's/(ProxyCommand
\/usr\/bin\/sss_ssh_knownhostsproxy -p \%p \%h)/# replaced by ipa-client
update\n    KnownHostsCommand \/usr\/bin\/sss_ssh_knownhosts \%H/'
$SSH_CLIENT_SYSTEM_CONF
                 fi
             fi
         fi
     fi
     ```

     /etc/ssh/ssh_config.d/04-ipa.conf after fix
     ```
     # IPA-related configuration changes to ssh_config
     #
     PubkeyAuthentication yes
     # disabled by ipa-client update
     # GlobalKnownHostsFile /var/lib/sss/pubconf/known_hosts
     #VerifyHostKeyDNS yes

     # assumes that if a user does not have shell (/sbin/nologin),
     # this will return nonzero exit code and proxy command will be ignored
     Match exec true
             # replaced by ipa-client update
         KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H
     ```

Subscribe