I have put up a web page at http://josefsson.org/gss/gss-lsh.html
with some information and the current patch. It works fairly well, but some minor issues in the specification probably doesn't work. I hope I have fixed the problems mentioned earlier. Let me know what you think. I'm going to test it with other GSS libraries now. ObWarning: I didn't review it for logical security flaws. There could be major holes. > I suspect some extra logic is needed, but perhaps not much. Consider a > client sending > > SSH_MSG_USERAUTH "gssapi" (starting a gssapi "session") > SSH_MSG_USERAUTH "none" (restarting authentication) > SSH_MSG_USERAUTH_GSSAPI_TOKEN > > Then the client should get a protocol error, but it might make contact > with your old handler which is still installed. It might be simple to > fix, by having the handler for SSH_MSG_USERAUTH reset all handlers for > messages in the userauth range. Yes, sounds reasonable. One additional thing would be required: how do I make the GC invoke a function (do_gc_gssapi() in the patch above) when a gssapi_server_instance class instance is gc'ed? The GSS library allocates some resources that should be deallocated if an authentication attempt is aborted. >> > Can gss_acquire_cred (or other gss-api functions) block, for example >> > for contacting a kerberos server? Then the entire lshd server will >> > block too. >> >> What is the worst problem this could cause anyway? I can only think >> of the lsh server core being delayed when responding to the client, >> but the client should kind of expect this anyway, when it requests a >> GSS mechanism that takes a very long time to finish. > > What will happen is that the lshd server will block and stop > responding on *all* connections, for all users. So it's a denial of > service attack on the other users of the system. Oops, I didn't think of this. OK, it seems fairly clear that GSS should be invoked from a different process, which communicate with the lsh core using some protocol, then. Still, since kerberos 5 GSS mechanism is fast, this is probably not a show-stopper. I think I'll leave this as an exercise. Thanks for the guidance, Simon _______________________________________________ lsh-bugs mailing list [EMAIL PROTECTED] http://lists.lysator.liu.se/mailman/listinfo/lsh-bugs
