Subject: reauthentication

From: Jakob Schlyter <[email-masked]>
Date: Tue, 28 Aug 2001 16:27:07 +0200 (MEST)

hi,

has anyone considered adding reauthentication support for ssh? I like the
server to request that the client reauthenticates from time to time.

this could be very useful for some authentication methods, e.g. smartcard,
where the authentication process requires a physical device to be attached
to the client - if the device is removed, the connection could be
terminated.

	jakob

---

From: Darren J Moffat <[email-masked]>
Date: Tue, 28 Aug 2001 12:43:58 -0700 (PDT)

> server to request that the client reauthenticates from time to time.

Expiring credentials was breifly touched appon at the 50th IETF when
disucssing the GSS drafts - since the underlying Kerberos tickets will
expire what should happen to the SSH protocol connection.

> to the client - if the device is removed, the connection could be

The server would have to trust that the client told it the card went away
since the server would not have direct access to the card itself.

In fact the server would never actually know a card was been used all
the server knows is what authentication mech was user in ssh-userauth.

--
Darren J Moffat

---

From: Jakob Schlyter <[email-masked]>
Date: Tue, 28 Aug 2001 21:58:58 +0200 (MEST)

> since the server would not have direct access to the card itself.

if the card is removed the client can't reauthenticate (since the private
key is only on the card).

> the server knows is what authentication mech was user in ssh-userauth.

the administrator can choose only to trust public keys (raw or from x.509
certificates) known to come from smartcards.

	jakob

---

From: Darren J Moffat <[email-masked]>
Date: Tue, 28 Aug 2001 13:04:19 -0700 (PDT)

> key is only on the card).

Correct but that doesn't happen when the card is removed only when
the reauthentication triggers from the server side of the connection,
which isn't how I had read your suggestion.

If you are happy with that then it takes smartcard out of the picture
as far as the protocol is concerned but should provide you with near
to the functionality you want with a smartcard being removed.

> certificates) known to come from smartcards.

That isn't a protocol issue then, but a site policy dependant on
some functionality in a particular implementation and some knowlege of
their own PKI infrastructure.  Which don't get me wrong will probably work
just fine.

--
Darren J Moffat

---

From: Jakob Schlyter <[email-masked]>
Date: Tue, 28 Aug 2001 22:13:42 +0200 (MEST)

> which isn't how I had read your suggestion.

reauthentication would always be requested by the server and reponded to
by the client. I can't currently see why the client would like request
reauthentication.

> to the functionality you want with a smartcard being removed.

the smartcard was just an example, I could see uses for reauthentication
for other methods like passwords, challenge-response and kerberos.

reauthentication is gives the server the possibly to check if "someone" is
still there. once again, this is still dependant on the authentication
method - e.g. if the client is using an ssh key agent, thet "someone"
might always be there.

	jakob