Arch Linux

DJArch

Member

Registered: 2021-06-23

Posts: 17

[SOLVED] SSH with GSSAPITrustDns

I am trying to ssh into a remote server without the need of a password. Copying my public ssh-key into server's

~/.ssh/authorized_keys

didn't work, and I found some instructions that said that I had to authenticate with Kerberos (whatever that means). I blindly followed the instructions:

kinit -f me@MY.COMPANY

And then edited local

~/.ssh/config

as:

Host something
    Hostname MY.COMPANY
    User me
    GSSAPIAuthentication yes
    GSSAPIDelegateCredentials yes
    GSSAPITrustDns yes

But when I try to

ssh something

, I get the error:

/home/me/.ssh/config: line 6: Bad configuration option: gssapitrustdns
/home/me/.ssh/config: terminating, 1 bad configuration options

I found some old threads (10+ years ago) with similar issues. They stated that the solution was to install some random AUR packages.

How can I fix this?
Thanks

Last edited by DJArch (2022-07-01 20:06:46)

tucuxi

Member

From: Switzerland

Registered: 2020-03-08

Posts: 291

Re: [SOLVED] SSH with GSSAPITrustDns

In the spirit of the error message, remove GSSAPITrustDns. man ssh_config also suggests that the option no longer exists.

DJArch

Member

Registered: 2021-06-23

Posts: 17

Re: [SOLVED] SSH with GSSAPITrustDns

In the spirit of the error message, remove GSSAPITrustDns. man ssh_config also suggests that the option no longer exists.

That is the problem. The option should exist, but it doesn't in Arch. https://linux.die.net/man/5/ssh_config

loqs

Member

Registered: 2014-03-06

Posts: 17,325

Re: [SOLVED] SSH with GSSAPITrustDns

The option does not exist as Arch does not carry the gssapi.patch that has been rejected by upstream.

Can you provide more details of the failure when you tried to use a key to login with an SSH key?

DJArch

Member

Registered: 2021-06-23

Posts: 17

Re: [SOLVED] SSH with GSSAPITrustDns

I managed to solve it by adding the following to

 /etc/krb5.conf

file:

[libdefaults]
    rdns = false

It would be good if someone could provide an explanation of why this works, or if there is a better fix. At least it is solved.