[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Support for multiple GSS libs
- To: Simon Wilkinson <firstname.lastname@example.org>, Simon Wilkinson <email@example.com>, Daniel Kouril <firstname.lastname@example.org>, email@example.com, Heimdal discussion list <firstname.lastname@example.org>
- Subject: Re: Support for multiple GSS libs
- From: Nicolas Williams <Nicolas.Williams@ubsw.com>
- Date: Wed, 7 Nov 2001 12:54:32 -0500
- In-Reply-To: <email@example.com>; from Simon Wilkinson on Wed, Nov 07, 2001 at 05:40:26PM +0000
- Mail-Followup-To: Simon Wilkinson <firstname.lastname@example.org>,Simon Wilkinson <email@example.com>,Daniel Kouril <firstname.lastname@example.org>, email@example.com,Heimdal discussion list <firstname.lastname@example.org>
- References: <200111071651.QAA25065@canna.dcs.ed.ac.uk> <20011107123053.I26615@wdr.com> <email@example.com>
- Sender: firstname.lastname@example.org
Ah. But you still need the ability to select the mech at runtime -- by
that point only dlopen()/dlsym() at the app level or mechglue in the GSS
libs will help.
Q: Why prohibit the use of SPNEGO in SSH? Are there archives where the
issue was discussed that I can read?
Is it because, if GSS is selected, but the GSS mech negotiated by
SPNEGO is not accpetable, then there is no way to go back and
re-negotiate at the SSH level? Is there no way to go back and
re-negotiate at the SSH level?
On Wed, Nov 07, 2001 at 05:40:26PM +0000, Simon Wilkinson wrote:
> On Wednesday 07 November 2001 17:30, Nicolas Williams wrote:
> > To negotiate which mech to use you'd need an SPNEGO implementation. And
> > the mechglue.
> Not within the context of OpenSSH. The GSSAPI drafts for SSH specifically
> prohibit the use of SPNEGO and instead mechanism negotiation is performed at
> the same time as all other key exchange / user authentication negotiation,
> within the SSH protocol.
> Simon Wilkinson <email@example.com> http://www.sxw.org.uk
> "Do not meddle in the affairs of wizards, for you are crunchy and good with
-DISCLAIMER: an automatically appended disclaimer may follow. By posting-
-to a public e-mail mailing list I hereby grant permission to distribute-
-and copy this message.-
Visit our website at http://www.ubswarburg.com
This message contains confidential information and is intended only
for the individual named. If you are not the named addressee you
should not disseminate, distribute or copy this e-mail. Please
notify the sender immediately by e-mail if you have received this
e-mail by mistake and delete this e-mail from your system.
E-mail transmission cannot be guaranteed to be secure or error-free
as information could be intercepted, corrupted, lost, destroyed,
arrive late or incomplete, or contain viruses. The sender therefore
does not accept liability for any errors or omissions in the contents
of this message which arise as a result of e-mail transmission. If
verification is required please request a hard-copy version. This
message is provided for informational purposes and should not be
construed as a solicitation or offer to buy or sell any securities or
related financial instruments.