August 1st (2006), a security update to Mac OS X 10.4.7 broke
connectivity to many Fermilab systems. This was a result of
Apple's updating SSH to a new version that is unfortunately
incompatible with the release of OpenSSH in use on many Fermilab
servers. This has recurred with the recent (March 13th 2007) release of
Mac OS X 10.4.9 which upgraded SSH again. This same incompatibility
also affects users of Scientific Linux (not
SLF) 4.x as SL 4 includes a newer version of OpenSSH. The
is an incompatiblity between the Kerberos/GSSAPI authentication methods
between the older and newer versions of OpenSSH. Prior to OpenSSH 3.5,
Kerberized SSH used the GSSAPI authentication method. As of
OpenSSH 3.5, this was replaced with the GSSAPI-with-MIC authentication
method which is incompatible with the older releases. This
incompatibility extends into the 4.x releases of OpenSSH now common on
Mac OS X.
We expect this to be solved shortly by a new release of Fermi Kerberos coupled with a new release of OpenSSH for Scientific Linux Fermi. In the meantime, the workaround for this Mac OS X problem is to re-install the old SSH client (but do replace the new SSH). Tarballs with these old SSH versions can be found on the Security Tools page. Once you have downloaded and unpacked the tarball, move the new version out of the way, copy the old version in place, change the ownership of the old version to match that of the new version and create a symbolic link to the old version:
sudo mv /usr/bin/ssh /usr/sbin/ssh.new
sudo mv <path>/ssh.old /usr/bin/
sudo chown root:wheel /usr/bin/ssh.old
ln -s /usr/bin/ssh.old /usr/bin/ssh
A new release of Fermi Kerberos is being tested which is needed to support the newer releases of OpenSSH. In addition, work is on-going to build a release of OpenSSH for Scientific Linux which supports both the old and new GSSAPI authentication methods. This version of OpenSSH (both client and server) is expected to replace the OpenSSH currently supported on SLF 3.x and 4.x.
As of August 31st, new OpenSSH packages are available for Scientific Linux Fermi in the fermi-testing area.
To install these test versions with YUM: