#858874 openssh-server: gssapi-keyex userauth fails with privsep and AuthenticationMethods both configured

Package:
openssh-server
Source:
openssh
Description:
secure shell (SSH) server, for secure access from remote machines
Submitter:
Eashwar Ranganathan
Date:
2026-08-23 11:43:05 UTC
Severity:
normal
#858874#5
Date:
2017-03-28 05:08:19 UTC
From:
To:
I have a server running openssh-server at the 'edge' of my kerberos realm. From here I can jump into the rest of the network. When I try to connect to it from within the realm, however, the connection fails because it attempts to remove 'gssapi-with-mic' from the auth methods list instead of 'gssapi-keyex'.

The important lines in the configuration file are as follows:

# Technically, privsep can be set to anything but no
UsePrivilegeSeparation sandbox
GSSAPIKeyExchange yes
AuthenticationMethods publickey,keyboard-interactive:pam gssapi-keyex

debug1: userauth-request for user eashwar service ssh-connection method gssapi-keyex [preauth]
debug1: attempt 1 failures 0 [preauth]
debug2: input_userauth_request: try method gssapi-keyex [preauth]
debug3: mm_request_send entering: type 48 [preauth]
debug3: mm_request_receive_expect entering: type 49 [preauth]
debug3: mm_request_receive entering [preauth]
debug3: mm_request_receive entering
debug3: monitor_read: checking request 4
debug3: mm_answer_authserv: service=ssh-connection, style=, role=
debug2: monitor_read: 4 used once, disabling now
debug3: mm_request_receive entering
debug3: monitor_read: checking request 48
debug3: mm_request_send entering: type 49
debug3: mm_request_send entering: type 46 [preauth]
debug3: mm_request_receive_expect entering: type 47 [preauth]
debug3: mm_request_receive entering [preauth]
debug3: mm_request_receive entering
debug3: monitor_read: checking request 46
Authorized to eashwar, krb5 principal eashwar@EXAMPLE.COM (krb5_kuserok)
debug3: mm_answer_gss_userok: sending result 1
debug3: mm_request_send entering: type 47
debug3: auth2_update_methods_lists: updating methods list after "gssapi-with-mic"
auth2_update_methods_lists: method not in AuthenticationMethods
debug1: do_cleanup
debug1: PAM: cleanup
debug3: PAM: sshpam_thread_cleanup entering
debug1: Killing privsep child 5349

I am working on a patch to address this by passing the auth method name to mm_answer_gss_userok through the buffer that it receives, but perhaps you have a better idea?

Regards,
Eashwar Ranganathan