openssh bugs - Feb 2011 - [Bug 1868] New: 'ssh -k' should explicitly disable gss auth

https://bugzilla.mindrot.org/show_bug.cgi?id=1868

           Summary: 'ssh -k' should explicitly disable gss auth
           Product: Portable OpenSSH
           Version: 5.8p1
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Kerberos support
        AssignedTo: unassigned-bugs at mindrot.org
        ReportedBy: frank+ssh at linetwo.net


in ssh.c, the option handling for 'k' should disable gss auth.  There
should be an explicit

  options.gss_authentication = 0;

at ssh.c:362, mirroring the 'K' option handling just below that line.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1868

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |djm at mindrot.org

--- Comment #1 from Damien Miller <djm at mindrot.org> 2011-05-06 11:58:44
EST ---
I think the issue here is that -K and -k are not completely
symmetrical:
>  -K   Enables GSSAPI-based authentication and forwarding (delegation)
>       of GSSAPI credentials to the server.
> 
>  -k   Disables forwarding (delegation) of GSSAPI credentials to the
>       server.
I think the rationale is that delegation requires authentication to be
useful, but disabling delegation without disabling authentication is a
useful thing to do too.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1868

--- Comment #2 from Frank Cusack <frank+ssh at linetwo.net> 2011-05-11
06:40:10 EST ---
My mistake.  Current usage is fine.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1868

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |WONTFIX

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1868

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #3 from Damien Miller <djm at mindrot.org> 2011-09-06 15:32:56
EST ---
close resolved bugs now that openssh-5.9 has been released

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.