1 files changed, 27 insertions, 5 deletions

diff --git a/debian/openssh-server.postinst b/debian/openssh-server.postinst
index 4e91098df..ee660165e 100644
--- a/debian/openssh-server.postinst
+++ b/debian/openssh-server.postinst
@@ -72,10 +72,23 @@ set_config_option() {
 }
 
 
-remove_obsolete_gssapi() {
-        grep -qi '^[    ]*GSSAPINoMICAuthentication' /etc/ssh/sshd_config \
-                || return 0
-        perl -pe 's/^(\s*GSSAPINoMICAuthentication)/\#$1/i' \
+disable_config_option() {
+        option="$1"
+
+        value="$(get_config_option "$option")"
+        [ "$value" ] || return 0
+
+        perl -le '
+                $option = $ARGV[0];
+                while (<STDIN>) {
+                        chomp;
+                        (my $match = $_) =~ s/\s+/ /g;
+                        # TODO: actually only one "=" allowed after option
+                        if ($match =~ s/^(\s*\Q$option\E[[:space:]=]+.*)/#$1/i) {
+                                $_ = $match;
+                        }
+                        print;
+                }' \
                 < /etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new
         chown --reference /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-new
         chmod --reference /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-new
@@ -83,6 +96,13 @@ remove_obsolete_gssapi() {
 }
 
 
+remove_obsolete_gssapi() {
+        disable_config_option GSSAPINoMICAuthentication
+        disable_config_option GSSUseSessionCCache
+        disable_config_option GSSAPIUseSessionCredCache
+}
+
+
 host_keys_required() {
         hostkeys="$(get_config_option HostKey)"
         if [ "$hostkeys" ]; then
@@ -202,7 +222,9 @@ create_sshdconfig() {
                 fi
 
                 # Remove obsolete GSSAPI options.
-                remove_obsolete_gssapi
+                if dpkg --compare-versions "$oldversion" lt 1:4.3p2-8; then
+                    remove_obsolete_gssapi
+                fi
 
                 return 0
             fi