Subject: SSH Kerberos packet exchange

From: [email-masked] (Karol Zielonko)
Date: Sat, 9 Jul 2005 07:56:10 -0400 (EDT)

I am trying to get the Kerberos authentication code working in our VMS port of
SSH. (It is based on SSH Comm. Inc's version 3.2.0). I know next to nothing
about Kerberos (and only slightly more about ssh ;^). I'm looking for a draft
or RFC that specifies the packet exchange over SSH that implements Kerberos
authentication. Can anyone point me in the right direction?

Thanks in advance,

Karol Zielonko

---

From: [email-masked]
Date: Sat, 9 Jul 2005 18:23:33 +0100 (BST)

> authentication. Can anyone point me in the right direction?

http://www.ietf.org/internet-drafts/draft-ietf-secsh-gsskeyex-09.txt

Although, at one point, ssh.com did have their own Kerberos mechanism, 
named [email-masked]. I'm not sure whether they still use this, or 
now use the GSSAPI mechansism described above. kerberos-2 was never 
standardised, and I'm not sure if its documented anywhere.

Cheers,

Simon.

---

From: "Karol Zielonko" <[email-masked]>
Date: Sun, 10 Jul 2005 15:48:54 -0400

Thank you.

> named [email-masked]

Unfortunately the version of SSH that I'm working on, 3.2.0, uses
the  [email-masked] variant. Anybody know if this one's packet
exchange is documented anywhere?

Karol

---

From: Markus Friedl <[email-masked]>
Date: Mon, 11 Jul 2005 11:11:56 +0200

> exchange is documented anywhere?

http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/Attic/auth2-krb5.c?rev=1.2&content-type=text/x-cvsweb-markup

contains the old openssh code for this.  it got removed
because it's not really secure and is now replaced by
the GSSAPI variant.