OpenBSD Journal

Kerberos Support in OpenSSH

Contributed by Dengue on from the a-blowfish-and-his-3-headed-dog dept.

BSDForums.org writes : "Marshall Vale writes on behalf of the MIT Kerberos team and several other parties interested in the availability of Kerberos authentication for the SSH protocol. Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography. Marshall says that Kerberos support within OpenSSH may be incomplete and needs more work . In particular, implementing draft-ietf-secsh-gsskeyex in addition to any other Kerberos mechanisms will better serve the needs of Kerberos community. Secondly, he says that they would like to reduce user confusion associated with all of the different options for Kerberos and SSH. He suggests adoption of the GSSAPI key exchange mechanism in the IETF draft (which uses Kerberos to authenticate both parties to each other), in order to avoid man-in-the-middle attacks."

(Comments are closed)

Comments

  1. By Anonymous Coward () on

    If I remember correctly, Raadt wrote on a mailing list this spring that OpenBSD Kerberos development was not progressing as desired. Very much of Kerberos work was done during hackatons, but otherwise pretty quiet.

    Comments

    1. By Anonymous Coward () on

      Yeah there's just noone who really wants to get into it enough.

    2. By Hugo Villeneuve () hugo@EINTR.net on http://EINTR.net

      This is a different issue.

      OpenBSD doesn't include the MIT Kerberos because of the restriction put on american security software.

      OpenBSD includes Kerberos IV and V from a .se group called KTH. Theo's complaint about unmaintened kerberos implemantation is about those 2 versions comming from KTH, not MIT one which OpenBSD doesn't use).

      Comments

      1. By Anonymous Coward () on

        KTH is the "Royal Institute of Technology" in Sweden, a school. I couldn't find out if there were students working on the project or any staff thou.

        Comments

        1. By Henrik Holmboe () on

          This is most likely Heimdal or some related software.

  2. By markus () markus@openbsd.org on mailto:markus@openbsd.org

    they should audit the gss api patches
    instead of spending time on writing
    long emails.

    i doubt the gss-api kex will make it into
    openssh soon. however, the gss api userauth
    might replace the current kerberos code.

    -m

Latest Articles

Credits

Copyright © - Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]