#660995 openssh-server: Better document the security implications of disabling GSSAPIStrictAcceptorCheck

Package:
openssh-server
Source:
openssh
Description:
secure shell (SSH) server, for secure access from remote machines
Submitter:
Sam Morris
Date:
2026-08-23 11:43:03 UTC
Severity:
wishlist
#660995#5
Date:
2012-02-23 12:23:11 UTC
From:
To:
At first glance the GSSAPIStrictAcceptorCheck options seems quite useful
on multi-homed hosts, but I don't think the existing documentation makes
it clear enough that enabling it will allow clients to use tickets for
*any* service in /etc/krb5.keytab, not just any 'host' key.

This is mentioned at
<https://bugzilla.mindrot.org/show_bug.cgi?id=928#c6> and
<http://newsgroups.derkeiler.com/Archive/Comp/comp.protocols.kerberos/2010-12/msg00081.html>.

I have tried to improve the wording of the option description in
sshd_config(5). The current wording states:

	If “no” then the client may authenticate against any service key
	stored in the machine's default store.

I suggest changing it to:

	If “no” then the client may authenticate against *any* service
	key stored in the machine's default store. This is not limited
	to just 'host' keys, so if set to “no” then ensure you use
	dedicated keytabs for all other services on the machine in
	question.