<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">This may need to be passed upstream to the SSH maintainers or openssh folks, but:<div>(Centos 6.4, ipa-client 3.0.0-26, openssh-5.3p1-84.1 )</div><div><br></div><div>IPA (sssd) when installed is to modify the /etc/ssh/ssh_config file, by adding (at least) a line :</div><div><br></div><div>GlobalKnownHostsFile <span style="background-color: rgb(255, 255, 255); font-family: 'Lucida Grande'; ">/var/lib/sss/pubconf/known_hosts</span></div><div><span style="background-color: rgb(255, 255, 255); font-family: 'Lucida Grande'; "><br></span></div><div><font face="Lucida Grande">Default behavior of SSH when that isn't present is to check both </font></div><div><span style="font-family: 'Lucida Grande'; background-color: rgb(255, 255, 255); ">/etc/ssh/ssh_known_hosts2 & </span><span style="font-family: 'Lucida Grande'; background-color: rgb(255, 255, 255); ">/etc/ssh/ssh_known_hosts for keys. This is documented in the ssh_config man page.</span><br><div><br class="webkit-block-placeholder"></div><div><br class="webkit-block-placeholder"></div><div>However, when the line is present with the sssd change, the OS only checks for <span style="background-color: rgb(255, 255, 255); font-family: 'Lucida Grande'; ">/etc/ssh/ssh_known_hosts2, plus the file in /var/lib/sss.</span></div><div><span style="background-color: rgb(255, 255, 255); font-family: 'Lucida Grande'; "><br></span></div><div><span style="background-color: rgb(255, 255, 255); font-family: 'Lucida Grande'; ">It still checks for both $HOME/.ssh/known_hosts & </span><span style="background-color: rgb(255, 255, 255); font-family: 'Lucida Grande'; "> </span><span style="background-color: rgb(255, 255, 255); "><font face="Lucida Grande">$HOME/.ssh/known_hosts, either way. (that's controlled by a different option.)</font></span></div><div><br class="webkit-block-placeholder"></div><div><br class="webkit-block-placeholder"></div><div>Should IPA / SSSD be adding back in the default value, until such time as it's fixed in the upstream?</div><div apple-content-edited="true"> <span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px; "><div><br class="Apple-interchange-newline"><br></div><div>Matthew Barr</div><div>Technical Architect</div><div>E: <a href="mailto:mbarr@snap-interactive.com">mbarr@snap-interactive.com</a></div><div>AIM: matthewbarr1</div><div>c: (646) 727-0535</div></span> </div> <br></div></body></html>