On Mon, Jun 24, 2002 at 09:53:09AM -0400, Perry E. Metzger wrote:

 > extension. You can also use Kerberos authentication with SSH, you know.

Not really.

While there is an I-D for GSSAPI for SSHv2, it has some real problems
that make it not very pleasant to use (some of these problems are side-
effects of the SSHv2 protocol itself).

One of the most annoying things about GSSAPI for SSHv2 is the occasional
rekeying that the SSHv2 transport does.  What happens is that the user's
ticket eventually expires during the login session, a rekey is attempted,
and the session is killed because the rekey failed due to expired ticket.
Now, while this may be strictly correct ("of course the session should
die once the ticket expires!"), it is different from every other login
mechanism that uses Kerberos that I am aware of.

There is a Kerberos 5 authentication method for SSHv1, but people are
trying to move away from SSHv1 because of the problems with that protocol.

(FreSSH has addressed some of the issues with SSHv1 with some extensions,
but the FreSSH developers haven't had time to work on FreSSH much for ...
quite a while, and these extensions only work with FreSSH anyway.)

Also, as far as I am aware (caveat: I haven't had much time to keep up
with the ietf-secsh mailing list), there aren't any Kerberized methods
for doing the host authentication in SSH (v1 or v2).  Because of this,
you still have a key distribution problem for the host keys.

-- 
        -- Jason R. Thorpe <thorpej@wasabisystems.com>