Description of problem:
ipa-client-install reconfigures sshd to use GSSAPI etc.the installer appends
the entries at the bottom of the file.
If the existing sshd_config contains a "Match" field, the configuration will
result in a sshd_config which prevents sshd from starting.
Excerpt from man 5 sshd_config
"Match Introduces a conditional block. If all of the criteria on the Match line
are satisfied, the keywords on the following lines override those set in the
global section of the config file, until either another Match line or the end
of the file".
This means that global parameters can not be added at the end of the config
file when a Match block comes in place.
Version-Release number of selected component (if applicable):
4.1
How reproducible:
Always
Steps to Reproduce:
1. Enter a Match filed in sshd_config. I.e.
Match Address 10.10.10.10
PermitRootLogin without-password
2. run ipa-client-installer
3. Find the following error message in /var/log/messages
sshd: /etc/ssh/sshd_config line 146: Directive 'UsePAM' is not allowed within a
Match block
Actual results:
Match Address 10.10.10.10
KerberosAuthentication no
PubkeyAuthentication yes
UsePAM yes
AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
GSSAPIAuthentication yes
AuthorizedKeysCommandUser nobody
PermitRootLogin without-password
Expected results:
KerberosAuthentication no
PubkeyAuthentication yes
UsePAM yes
AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
GSSAPIAuthentication yes
AuthorizedKeysCommandUser nobody
Match Address 10.10.10.10
PermitRootLogin without-password
Additional info:
Workaround is to use ipa-client-install --no-sshd and distribute a sshd_config
which fulfills IPA client requirements.