diff -up openssh-7.4p1/ssh_config.5.gss-docs openssh-7.4p1/ssh_config.5 --- openssh-7.4p1/ssh_config.5.gss-docs 2016-12-23 14:28:34.051714486 +0100 +++ openssh-7.4p1/ssh_config.5 2016-12-23 14:34:24.568522417 +0100 @@ -765,10 +765,19 @@ The default is If set to .Dq yes then renewal of the client's GSSAPI credentials will force the rekeying of the -ssh connection. With a compatible server, this can delegate the renewed +ssh connection. With a compatible server, this will delegate the renewed credentials to a session on the server. +.Pp +Checks are made to ensure that credentials are only propagated when the new +credentials match the old ones on the originating client and where the +receiving server still has the old set in its cache. +.Pp The default is .Dq no . +.Pp +For this to work +.Cm GSSAPIKeyExchange +needs to be enabled in the server and also used by the client. .It Cm GSSAPIServerIdentity If set, specifies the GSSAPI server identity that ssh should expect when connecting to the server. The default is unset, which means that the @@ -776,9 +785,11 @@ expected GSSAPI server identity will be hostname. .It Cm GSSAPITrustDns Set to -.Dq yes to indicate that the DNS is trusted to securely canonicalize +.Dq yes +to indicate that the DNS is trusted to securely canonicalize the name of the host being connected to. If -.Dq no, the hostname entered on the +.Dq no , +the hostname entered on the command line will be passed untouched to the GSSAPI library. The default is .Dq no . diff -up openssh-7.4p1/sshd_config.5.gss-docs openssh-7.4p1/sshd_config.5 --- openssh-7.4p1/sshd_config.5.gss-docs 2016-12-23 14:28:34.043714490 +0100 +++ openssh-7.4p1/sshd_config.5 2016-12-23 14:28:34.051714486 +0100 @@ -652,6 +652,10 @@ Controls whether the user's GSSAPI crede successful connection rekeying. This option can be used to accepted renewed or updated credentials from a compatible client. The default is .Dq no . +.Pp +For this to work +.Cm GSSAPIKeyExchange +needs to be enabled in the server and also used by the client. .It Cm HostbasedAcceptedKeyTypes Specifies the key types that will be accepted for hostbased authentication as a list of comma-separated patterns.