Subject: RE: Pending OpenSSH release: contains Kerberos/GSSAPI changes

From: "Wachdorf, Daniel R" <[email-masked]>
Date: Fri, 30 Jan 2004 15:59:22 -0700

Well,

It could be a problem. If someone has implemented a client and doesn't do
mutual auth (as the standard says they should), they could be broken.  

The fix is easy.  Just remove:

(*flags & GSS_C_MUTUAL_FLAG) &&
            (*flags & GSS_C_INTEG_FLAG))

from the if statement.  

I have already tested this out, it works fine.  I will make a diff if
someone tells me what to base if off of.

-----Original Message-----
From: Sam Hartman [mailto:[email-masked]] 
Sent: Friday, January 30, 2004 3:54 PM
To: Ben Lindstrom
Cc: Wachdorf, Daniel R; 'Jeffrey Hutzelman'; [email-masked];
[email-masked]; [email-masked]; [email-masked]; OpenSSH
Devel List
Subject: Re: Pending OpenSSH release: contains Kerberos/GSSAPI changes

>>>>> "Ben" == Ben Lindstrom <[email-masked]> writes:

    Ben> I need someone to look at this and get back to us ASAP in
    Ben> regards to if this will break GSSAPI-WITH-MIC.

It may make some conforming clients break but does not create a
security problem.

Some client implementers may choose to introduce an extra round trip
(which is what setting the mutual required flag does) in order to
interoperate with OpenSsh if the code is released in the current
state.

Really, that's probably OK if it happens.

I'd class this as a minor conformance issue, but not a huge deal.

---

From: Ben Lindstrom <[email-masked]>
Date: Fri, 30 Jan 2004 17:11:12 -0600 (CST)

> It could be a problem. If someone has implemented a client and doesn't do
								^^^^^^^^^^
> mutual auth (as the standard says they should), they could be broken.
   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This right here is the key to me.  If someone is not following the RFC.
Then I say let them complaint to their vendor.

Again I ask.. As the code stands are *WE* in RFC compliance?  If not we
need it fixed.

As for what to base it off of.  Pick a recent snapshot.  Not as if the
GSSAPI-WITH-MIC code has drasticly changed in the last few days.

- Ben