Subject: Re: PAM and OpenSSH
To: Greg Troxel <gdt@ir.bbn.com>
From: Roland Dowdeswell <elric@imrryr.org>
List: tech-userlevel
Date: 01/26/2005 10:15:00
On 1106751384 seconds since the Beginning of the UNIX epoch
Greg Troxel wrote:
>

>Do they claim the direct krb5 support has a security problem, or is
>this just "progress"?   Having both supported in our version sounds
>like a good plan.

The security of the krb5 methods is suboptimal[1].  But, I think
that forcing customers to not be able to upgrade is substantially
worse.  I do not think that we should necessarily continue to
support krb5 for ever, but we must have at least one or two versions
of NetBSD that supports both so that upgrading is actually possible.

[1] suboptimal doesn't mean remote root, or easy compromises.

--
    Roland Dowdeswell                      http://www.Imrryr.ORG/~elric/