Package: wnpp Severity: wishlist Owner: Colin Watson <[email protected]> X-Debbugs-Cc: [email protected]
* Package name : openssh-gssapi Version : 10.3p1 Upstream Contact: [email protected] * URL : https://www.openssh.com/ * License : BSD-3-clause Programming Lang: C Description : OpenSSH client and server with GSS-API support As discussed in https://lists.debian.org/debian-devel/2024/04/msg00044.html and thread, I've been intending to split out GSS-API support from the main OpenSSH packaging for some time. The GSS-API key exchange patch is about 3900 lines that is never likely to be accepted upstream, and accounts for 68% of our current patch volume all by itself, much of which is in the particularly security-critical pre-authentication parts of OpenSSH. We also configure OpenSSH using the --with-kerberos5 option, which causes sshd-auth and sshd-session to have significant extra library linkage that increases their exposure to attack chains. Having all of this installed only on systems that actually need it will reduce risk for most Debian users. I intend to maintain this as part of the SSH team (which admittedly is pretty much just me right now; if any Debian developers are interested in helping out, please contact me off-list) alongside the existing openssh and openssh-ssh1 source packages. Unlike openssh-ssh1 which is intentionally frozen at an old version, it should generally be possible to keep openssh-gssapi broadly in sync with openssh. -- Colin Watson (he/him) [[email protected]]
