openssh unix dev - Aug 2003 - GSSAPI patch sync from OpenBSD to Portable

Hi All.
	Markus has commited the long-awaited GSSAPI patch to OpenBSD's ssh.

	There are patches.  The first [1] is a straightforward port of the
OpenBSD code to Portable.

	The second [2] contains the parts I've stolen from Simon Wilkinson's
portable GSSAPI patch in an attempt to make it build.  It is incomplete
and doesn't currently work.

	The PAM support is not there and gss-serv-krb5.c is broken somehow
("macro "krb5_cc_gen_new" passed 3 arguments, but takes just
2").  I know
approximately zero Kerberos and I'm hoping someone who knows what
they're
doing can help sort this out.  Any takers?

	One other thing: shouldn't Simon now be listed as a copyright holder in
OpenSSH's LICENCE?

		-Daz.

[1] http://www.zip.com.au/~dtucker/openssh/openssh-gssapi.patch
[2] http://www.zip.com.au/~dtucker/openssh/openssh-gssapi-port.patch

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

See my note to this list "Re: updated gssapi diff" dated
"2003-08-19
18:51:02".  In order for MIT support not to be broken, you need the 
patch from Douglas Engert mentioned in my note.

Also, in session.c the calls to ssh_gssapi_storecreds() need to come 
before the calls to do_pam_session(), so that PAM can make use of any 
gssapi credentials that may get stored in a per-session cache.

With these two changes, your openssh-gssapi-port.patch will look 
something like what I've attached below.

Finally, I notice that you _did_ include one bit of PAM support from 
Simon Wilkinson's patch -- on line 825 of configure.ac you add the line 
"AC_CHECK_FUNCS(pam_putenv)".  If you're willing to go that far,
why not
  go all the way?  The only additional work is to copy Simon's 
do_pam_putenv() to auth-pam.c, put a definition of this function into 
auth-pam.h, and copy Simon's call to do_pam_putenv() to 
ssh_gssapi_krb5_storecreds() in gss-serv-krb5.c.
> 	The PAM support is not there and gss-serv-krb5.c is broken somehow
> ("macro "krb5_cc_gen_new" passed 3 arguments, but takes just
2").  I know
> approximately zero Kerberos and I'm hoping someone who knows what
they're
> doing can help sort this out.  Any takers?
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: openssh-gssapi-port.fixed.txt
Url:
http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20030822/33b8ab82/attachment.txt