From 79d69b223cd709bb8cede093ed13bcd187599728 Mon Sep 17 00:00:00 2001
From: Skye Soss <skye@soss.website>
Date: Thu, 8 Oct 2026 08:17:08 -0500
Subject: [PATCH] openssh: default withLdns to false

ldns support can be used by openssh to perform in-process DNSSEC
validation for ValidateHostKeyDNS=, but doing so also requires
configuration of non-standard /etc/resolv.conf options that NixOS
doesn't support.

(cherry picked from commit 0e0e7648c15bdfe55bd8eb11291b8cffd55c8cfa)
---
 pkgs/tools/networking/openssh/common.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/tools/networking/openssh/common.nix b/pkgs/tools/networking/openssh/common.nix
index d93f51d24cfd..c95ffbd75faa 100644
--- a/pkgs/tools/networking/openssh/common.nix
+++ b/pkgs/tools/networking/openssh/common.nix
@@ -30,7 +30,7 @@
   libredirect,
   etcDir ? null,
   withKerberos ? false,
-  withLdns ? true,
+  withLdns ? false,
   krb5,
   libfido2,
   libxcrypt,