When installing ipa client have an option to configure sshd to use gss proxy rather than access host keytab directly.
This make sense to do only if we change the OpenSSH privsep process to never have access to the keytab directly or indirectly via main privileged process.
Metadata Update from @dpal: - Issue assigned to someone - Issue set to the milestone: Tickets Deferred
Thank you taking time to submit this request for FreeIPA. Unfortunately this bug was not given priority and the team lacks the capacity to work on it at this time.
Given that we are unable to fulfil this request I am closing the issue as wontfix. To request re-consideration of this decision please reopen this issue and provide additional technical details about its importance to you.
Metadata Update from @rcritten: - Issue close_status updated to: wontfix - Issue status updated to: Closed (was: Open)
Login to comment on this ticket.