freeipa

#9536 Client configuration of ssh: Replace sss_ssh_knownhostsproxy with sss_ssh_knownhosts
Closed: fixed by antorres. Opened by frenaud.

Closed: fixed
Reopen Issue

SSSD is planning to deprecate the command sss_ssh_knownhostsproxy and replace it with sss_ssh_knownhosts (see ticket sssd #5518 and PR SSSD/7144).

During the client installation, FreeIPA configures either /etc/ssh/ssh_config or /etc/ssh/ssh_config.d/04-ipa.conf (if SSH supports the Include directive) with the directive

ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h

If the file /usr/bin/sss_ssh_knownhosts is present, it should be used instead of /usr/bin/sss_ssh_knownhostsproxy.

Upgrade from older versions should also take care of this change.

JFYI: SSSD patch - https://github.com/SSSD/sssd/commit/953c6bee49123625e08e9ec35375d4f539a878da - was just merged, so will be available in next nightly build of sssd-2.10

Metadata Update from @ftrivino:
- Issue assigned to ftrivino

Metadata Update from @ftrivino:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/7254

@ftrivino , what's the plan here?

SSSD plans to ship sssd-2.10 version in f-41 without sss_ssh_knownhostsproxy

Update: sorry missed https://github.com/freeipa/freeipa/pull/7254. So it seems to be on a good track.
Edited by atikhonov

master:

  • 7d54a6daaf0ef91d608d67b3c70e2d566868be05 ipa-client-install: add support for sss_ssh_knownhosts
  • b34525c76e9f8182950bbbdd6fa3ae62f5301064 Spec file: add support for sss_ssh_knownhosts

ipa-4-11:

  • bd2010fa9ee3f7b8b8a994777c981ce245e52d6e ipa-client-install: add support for sss_ssh_knownhosts
  • a41e5e2a244f8fa2edfd7db1e821d8b0f3bbd997 Spec file: add support for sss_ssh_knownhosts

Metadata Update from @antorres:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @ftrivino:
- Custom field changelog adjusted to Deprecated sss_ssh_knownhostsproxy in favor of sss_ssh_knownhosts. With this update, if /usr/bin/sss_ssh_knownhosts is present, it will be used instead of /usr/bin/sss_ssh_knownhostsproxy. We implemented a mechanism to apply this change when upgrading from older versions, and downgrading from newer versions.

master:

  • 2cb6e446dd3b6d9bda33635c1ca832148251f9bf Installer: activate ssh service in sssd.conf

ipa-4-12:

  • 373d41f211c1a04dc432a068bc7d2ba825ff554c Installer: activate ssh service in sssd.conf

ipa-4-11:

  • 97aec5f36dd6558326b69fd60927014bae9e87d4 Installer: activate ssh service in sssd.conf
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.