Backport of:

From 8058c5bdb507591b79ec926221fbe6fcc296d432 Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Wed, 24 Jun 2026 06:55:12 +0000
Subject: [PATCH] upstream: mention a caveat regarding
 GSSAPIStrictAcceptorCheck in

some environments

OpenBSD-Commit-ID: aa7158d8f22cb34063c1c2d3cbcf30a9489847c2
---
 sshd_config.5 | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/sshd_config.5
+++ b/sshd_config.5
@@ -703,6 +703,7 @@ machine's default store.
 This facility is provided to assist with operation on multi homed machines.
 The default is
 .Cm yes .
+This option may not be effective in Windows Active Directory environments.
 .It Cm GSSAPIStoreCredentialsOnRekey
 Controls whether the user's GSSAPI credentials should be updated following a
 successful connection rekeying. This option can be used to accepted renewed
