#
# Originally we planned to only deprecate client config (ssh_config) options 
# and leave it up to system administrators to remove all SunSSH specific
# server config (sshd_config) options. In internal testing we have discovered,
# that this would bring too much trouble to the said administrators.
# The probability of these options appearing in existing sshd_config files
# is higher than initially though, because some of the options have been in
# default sshd_config file for very long time. Also the consequence of
# unknown server option is harsh - ssh service goes to maintenance mode
# possible rendering the instance not accessible. For this reason we will
# deprecate SunSSH specific sshd_config options too.
#
# This is a Solaris specific change to ease the transition and will not be
# offered upstream.
#
diff -pur old/servconf.c new/servconf.c
--- old/servconf.c
+++ new/servconf.c
@@ -518,6 +518,7 @@ static struct {
 	{ "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
 #ifdef GSSAPI
 	{ "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
+	{ "gssauthentication", sGssAuthentication, SSHCFG_ALL },   /* alias */
 #ifdef USE_GSS_STORE_CRED
 	{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
 #else /* USE_GSS_STORE_CRED */
@@ -526,6 +527,7 @@ static struct {
 	{ "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
 #else
 	{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
+	{ "gssauthentication", sUnsupported, SSHCFG_ALL },          /* alias */
 	{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
 	{ "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
 #endif
@@ -592,6 +594,30 @@ static struct {
 	{ "pamserviceprefix", sPAMServicePrefix, SSHCFG_GLOBAL },
 	{ "pamservicename", sPAMServiceName, SSHCFG_GLOBAL },
 #endif
+#ifdef DEPRECATE_SUNSSH_OPT
+	/*
+	 * On Solaris, to make the transition from SunSSH to OpenSSH as smooth
+	 * as possible, we will deprecate SunSSH-only options in OpenSSH.
+	 * Therefore on a system having one of the following options in
+	 * /etc/ssh/sshd_config, change to OpenSSH will not result in service
+	 * network/ssh going to maintenance. Instead, a warning will be printed
+	 * to /var/svc/log/network-ssh:default.log. Note that
+	 * this is an interim enhancement to OpenSSH to make the transition
+	 * smoother.  If a deprecated SunSSH-only option is migrated to OpenSSH
+	 * later, then it will be changed from deprecated to supported.
+	 */
+	{ "maxauthtrieslog", sDeprecated, SSHCFG_GLOBAL },
+	{ "lookupclienthostnames", sDeprecated, SSHCFG_GLOBAL },
+	{ "useopensslengine", sDeprecated, SSHCFG_GLOBAL },
+	{ "preuserauthhook", sDeprecated, SSHCFG_ALL},
+	{ "kmfpolicydatabase", sDeprecated, SSHCFG_GLOBAL },
+	{ "kmfpolicyname", sDeprecated, SSHCFG_GLOBAL },
+	{ "trustedanchorkeystore", sDeprecated, SSHCFG_GLOBAL },
+	{ "useunsupportedsshv1", sDeprecated, SSHCFG_GLOBAL },
+	{ "usefips140", sDeprecated, SSHCFG_ALL},
+	{ "gssapistoredelegatedcredentials", sDeprecated, SSHCFG_ALL },
+	{ "gssstoredelegcreds", sDeprecated, SSHCFG_ALL },
+#endif
 	{ "revokedkeys", sRevokedKeys, SSHCFG_ALL },
 	{ "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
 	{ "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL },