Just if someone doesn't know this patch: http://dev.inversepath.com/trac/openssh-lpk I think can be useful for FreeIPAv2 to solve ssh key distribution (and don't want to/can't use kerberos). Cheers, Gippa P.S. Bugzilla was opened for this: https://bugzilla.redhat.com/show_bug.cgi?id=215741