Subject: Re: [Isms] mapping here, mapping there, mapping everywhere

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 2 Sep 2008 17:09:24 +0200

On Thu, Aug 28, 2008 at 07:05:36PM -0400, Jeffrey Hutzelman wrote:
 
> I suspect the best thing to do is to assume that the architecture has a 
> 32-character limit for security names, keep that same limit in TSM, and 
> arrange for SSHTM to never emit names longer than that. 

I tend to agree here (speaking as technical contributor).

> I think it is probably OK to say that...
> 
> - by default, the tmSecurityName produced by sshtm consists of the string
>   "ssh:" followed by the SSH username
> - if the tmSecurityName would exceed 32 characters in length, then sshtm
>   MUST instead generate some error/drop the request/whatever
> 
> The thing we perhaps leave unstated is that it is permissible to provide an 
> implementation-specific means to configure a non-default mapping, in which 
> sshtm produces a tmSecurityName consisting of the string "ssh:" followed by 
> something other than the SSH username.

As far as I understand the prefix proposal, I can select that prefixes
are not stripped. This essentially means that the length of SSH
usernames is limited to 32-strlen("ssh:"), no?

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
_______________________________________________
Isms mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/isms