Re: GSSAPI Key Exchange in sshd?
- From: Stefan Lambrev <stefan.lambrev@xxxxxxxxxxxxxxxx>
- Date: Thu, 20 Sep 2007 11:21:37 +0300
Hello,
Kevin Way wrote:
I'm curious if there are technical (or other) reasons that prevent FreeBSD from adding RFC 4462 (GSSAPI Key Exchange) support to sshd. The MIT Kerberos team first requested this four years ago, and implementation patches have been available for years at: http://www.sxw.org.uk/computing/patches/openssh.htmlI'm using openssh-portable from ports to do this. It is option there so you have a choice.
The author of those patches has offered (without much public response) to allow integration of the patches into the openssh source distribution, so I don't think licensing would be an issue.
This would be incredibly useful to me, as it'd remove the burden of site-wide ssh host key distribution.
Unfortunately there is no patch available for the latest (4.7) openssh, so we have to wait little.
It was explained many times why you should use ports if you want customization for apps like heimdal, openssh and perl (in the past when it was built-in in the base system).
Also it is quite more easy to maintain updates, when you use ports version for this.
Why it is not part of openssh I can only guess, but I'm sure it involves security problems (just like HPN patch), and that's why it is not part of the source tree of openssh.
Regards,
Kevin Way
_______________________________________________
freebsd-hackers@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@xxxxxxxxxxx"
--
Best Wishes,
Stefan Lambrev
ICQ# 24134177
_______________________________________________
freebsd-security@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@xxxxxxxxxxx"
- Prev by Date: [Resolved] Found a way of allowing pam_ldap users (with pam_groupdn or pam_check_host_attr restrictions), AND allowing local root authentication, without pam_unix.so taking presense due to getpwent() returns ldap-users
- Next by Date: OCF
- Previous by thread: [Resolved] Found a way of allowing pam_ldap users (with pam_groupdn or pam_check_host_attr restrictions), AND allowing local root authentication, without pam_unix.so taking presense due to getpwent() returns ldap-users
- Next by thread: OCF
- Index(es):
Relevant Pages
|
|
