SSH1 security with Kerb5

[Stephen Smoogen]

On Wed, 2003-05-28 at 08:05, Greg Lambert wrote:
> Hi,
>  
> I am trying to decide if it is worth the time to test the Kerberos
>  support in a port I am working on of Openssh 3.5p1.

>  
> Does using Kerb5 with SSH1 solve the security problems inherent in
> protocol 1 and bring it up to par with the security level of SSH2
> or are there other issues that Kerb5 authentication won't help for SSH1?

There are additional problems with how ssh1 does kerb5 in how it passes
Tickets and how it verifies the authenticity of the server. Depending on
the kerberos person you talk to you are either lowering your security by
using SSH1+Krb5 or just as vulnerable to SSH1 problems. 

The two approaches to doing KRB5 in ssh2 seem to be at loggerheads of
simplicity versus verification. To do the verification of kerb tickets
and server/host/user many are using GSSAPI. To be simple, the openssh
team is implementing a method used by some ssh.com v2 code. It fixes a
problem with passing tickets before verifying the user, but it does not
do some other krb5 verifications that some kerberos people wish to see.


-- 
Stephen John Smoogen		smoogen at lanl.gov
Los Alamos National Labrador  CCN-5 Sched 5/40  PH: 4-0645 (note new #)
Ta-03 SM-1498 MailStop B255 DP 10S  Los Alamos, NM 87545
-- So shines a good deed in a weary world. = Willy Wonka --
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20030528/7e2b3c97/attachment.bin