Rob, I’m not sure if we are talking about the same thing. In fact this part works for me too:
But it’s not here the problem. The problem is when starting HBA (Hostbased Authentication).
debug3: userauth_hostbased: trying key type ecdsa-sha2-nistp256
debug1: userauth_hostbased: trying hostkey ecdsa-sha2-nistp256 SHA256:Nwwv7gndOGwipEM3I8AGQEUX7OP9LvgFG0V7TXJ0XcI
debug3: send packet: type 50
debug2: we sent a hostbased packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,keyboard-interactive,hostbased
debug3: userauth_hostbased: trying key type ecdsa-sha2-nistp256
debug3: userauth_hostbased: trying key type ecdsa-sha2-nistp384
debug3: userauth_hostbased: trying key type ecdsa-sha2-nistp521
debug3: userauth_hostbased: trying key type ssh-ed25519
debug1: userauth_hostbased: trying hostkey ssh-ed25519 SHA256:9O5hkM8gLvGPcoZE9t5zbGxAxHGq7RsCZ5ScjltBZpQ
debug3: send packet: type 50
debug2: we sent a hostbased packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,keyboard-interactive,hostbased
debug3: userauth_hostbased: trying key type ssh-ed25519
debug3: userauth_hostbased: trying key type rsa-sha2-512
debug3: userauth_hostbased: trying key type rsa-sha2-256
debug3: userauth_hostbased: trying key type ssh-rsa
debug1: userauth_hostbased: trying hostkey ssh-rsa SHA256:+Zl4g2C+AALTHr0K/qkcSDkU6wVQ+CygatAn7x9bRUI
debug3: send packet: type 50
debug2: we sent a hostbased packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,keyboard-interactive,hostbased
debug3: userauth_hostbased: trying key type ssh-rsa
debug3: userauth_hostbased: trying key type ssh-dss
debug1: No more client hostkeys for hostbased authentication.
If I manually create the file: /etc/ssh/ssh_known_hosts with the entries it works, so it’s definitely not looking in /var/lib/sss/pubconf/known_hosts or the proxy isn’t being called during HBA.
If it’s still not clear what I mean I can try to rephrase it.
Thanks again.