Pending OpenSSH release: contains Kerberos/GSSAPI changes

Wachdorf, Daniel R drwachd at
Sat Jan 31 09:59:22 EST 2004


It could be a problem. If someone has implemented a client and doesn't do
mutual auth (as the standard says they should), they could be broken.  

The fix is easy.  Just remove:

(*flags & GSS_C_MUTUAL_FLAG) &&
            (*flags & GSS_C_INTEG_FLAG))

from the if statement.  

I have already tested this out, it works fine.  I will make a diff if
someone tells me what to base if off of.

-----Original Message-----
From: Sam Hartman [mailto:hartmans at] 
Sent: Friday, January 30, 2004 3:54 PM
To: Ben Lindstrom
Cc: Wachdorf, Daniel R; 'Jeffrey Hutzelman'; krbdev at;
ietf-ssh at; kerberos at; heimdal-discuss at; OpenSSH
Devel List
Subject: Re: Pending OpenSSH release: contains Kerberos/GSSAPI changes

>>>>> "Ben" == Ben Lindstrom <mouring at> writes:

    Ben> I need someone to look at this and get back to us ASAP in
    Ben> regards to if this will break GSSAPI-WITH-MIC.

It may make some conforming clients break but does not create a
security problem.

Some client implementers may choose to introduce an extra round trip
(which is what setting the mutual required flag does) in order to
interoperate with OpenSsh if the code is released in the current

Really, that's probably OK if it happens.

I'd class this as a minor conformance issue, but not a huge deal.

More information about the openssh-unix-dev mailing list