868241 - Disable GSSAPI in ssh

Status: RESOLVED FIXED

(Release Engineering :: General, defect)

Description

[Chris AtLee [:catlee]]

One (small) reason why our command queues back up is that it takes about one second for the GSSAPI negotiation to fail when ssh'ing from the master to stage.

GSSAPI is globally enabled in /etc/ssh/ssh_config. We should probably remove it from there, or override it in ~/.ssh/config

GSSAPIAuthentication=no

Comment 1

[Rail Aliiev [:rail]]

Is there any reason we want to have GSSAPIAuthentication=yes?

Comment 2

[Chris AtLee [:catlee]]

Not that I know of.

Comment 3

[Dustin J. Mitchell [:dustin] (he/him)]

Opsec folks, I think this is fine, but let us know if it's not?

Comment 4

[Michael Henry [:tinfoil]]

Nothing that I know of from OPsec requires GSS nor depends on it.

Personally, I'm all for disabling anything that we're not explicately using, just on principle.

Go for it.  :-)

Comment 5

[Rail Aliiev [:rail]]

Attachment: kill GSSAPI

Comment 6

[Dustin J. Mitchell [:dustin] (he/him)]

Comment on attachment 745216 [details] [diff] [review]
kill GSSAPI

Review of attachment 745216 [details] [diff] [review]:
-----------------------------------------------------------------

These should probably be explicit "no" instead of just removing them (even if the default is 'no', explicit is better than implicit)

Comment 7

[Rail Aliiev [:rail]]

Attachment: kill GSSAPI

Comment 8

[Rail Aliiev [:rail]]

Comment on attachment 745222 [details] [diff] [review]
kill GSSAPI

https://hg.mozilla.org/build/puppet/rev/c356f4f8f697