Subject: openssh-server-krb5-10.4.p1 for aarch64 no longer supports GSSAPIAuthentication

From: Scott Haiden <[email-masked]>
Date: Tue, 28 Jul 2026 22:00:10 -0700

Hello;

On a recent update to the openssh package I noticed SSHD was not coming 
up, and after debugging it I discovered that it was because my sshd 
config enables GSSAPIAuthentication, but sshd.krb5 is not recognizing 
that option.

     rpi-bot:/etc/ssh# sshd.krb5 -t
     /etc/ssh/sshd_config: line 76: Bad configuration option: 
GSSAPIAuthentication
     /etc/ssh/sshd_config: terminating, 1 bad configuration options

This actually started happening one update ago the current version is 
openssh-10.4_p1-r1; whatever version released immediately before that, 
presumably openssh-10.4_p1-r0 I think, I don't recall, also had this issue.

The build log does say it's being built with kerberos support, for what 
that is worth. 
https://build.alpinelinux.org/buildlogs/build-edge-x86_64/main/openssh/openssh-10.4_p1-r1.log

I'm wondering if I messed something up, or if there's a packaging issue? 
If I comment out the "GSSAPIAuthentication yes" line from my 
/etc/ssh/sshd_config then sshd starts up. But if I don't, it quits from 
a bad config option. 10.4p1 on another linux distro does support it, and 
I don't think it seems likely that the GSSAPIAuthentication  would be 
deprecated, so the only thing I can think of is a packaging issue, but 
it's also extremely possible I'm just doing something wrong on my end.

Thanks,
--Scott

---

From: Naomi Rennie-Waldock <[email-masked]>
Date: Wed, 29 Jul 2026 10:39:31 +0100

>On a recent update to the openssh package I noticed SSHD was not coming
up, and after debugging it I discovered that it was because my sshd config
enables GSSAPIAuthentication, but sshd.krb5 is not recognizing that option.
GSSAPIAuthentication
that is worth.
If I comment out the "GSSAPIAuthentication yes" line from my
/etc/ssh/sshd_config then sshd starts up. But if I don't, it quits from a
bad config option. 10.4p1 on another linux distro does support it, and I
don't think it seems likely that the GSSAPIAuthentication  would be
deprecated, so the only thing I can think of is a packaging issue, but it's
also extremely possible I'm just doing something wrong on my end.
>--Scott

Looks like this was a bug:
https://github.com/openssh/openssh-portable/commit/c147093565634eae9f91e4df99e04a6b3513f9c6

I'll test and submit a merge request.