openssh bugs - Nov 2015 - [Bug 2495] New: add GSI GSSAPI SSO authentication to OpenSSH

https://bugzilla.mindrot.org/show_bug.cgi?id=2495

            Bug ID: 2495
           Summary: add GSI GSSAPI SSO authentication to OpenSSH
           Product: Portable OpenSSH
           Version: 7.1p1
          Hardware: amd64
                OS: Linux
            Status: NEW
          Severity: enhancement
          Priority: P5
         Component: Kerberos support
          Assignee: unassigned-bugs at mindrot.org
          Reporter: thomas.downes at ligo.org

This is effectively a bump of bug 958, filed by Jim Basney, to the
current version of openssh. Jim maintains a patch for openssh which
enables authentication with GSI GSSAPI.

Effectively it enables single-sign-on with certificate verification by
the client of the host and of the client by the host. This is in use
securely by a large number of users in scientific and other computing
projects.

Patch:

http://grid.ncsa.illinois.edu/ssh/installpatch.html
http://grid.ncsa.illinois.edu/ssh/dl/patch/

Full releases:

https://github.com/globus/gsi-openssh/releases

We would like you to review this patch and consider it for inclusion in
the standard release of openssh. Currently, we are compelled to
recompile and repackage openssh ourselves on both linux and OS X.
Practically speaking, it can be hard to keep the packaging going
although I believe (hope) the burden on Jim of maintaining the patch
itself is fairly low.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2495

Tom Downes <thomas.downes at ligo.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jbasney at illinois.edu

--- Comment #1 from Tom Downes <thomas.downes at ligo.org> ---
*** Bug 958 has been marked as a duplicate of this bug. ***

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2495

Mantas M. <grawity at gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |grawity at gmail.com

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2495

Christoph Anton Mitterer <calestyo at scientia.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |calestyo at scientia.net

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2495

Maciej Pawlik <m.pawlik at cyfronet.pl> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |m.pawlik at cyfronet.pl

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2495

Peter Couvares <pfcouvar+bugzilla.mindrot at syr.edu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |pfcouvar+bugzilla.mindrot at s
                   |                            |yr.edu

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2495

Andre Merzky <andre at merzky.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |andre at merzky.net

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2495

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |djm at mindrot.org
         Resolution|---                         |WONTFIX
             Status|NEW                         |RESOLVED

--- Comment #2 from Damien Miller <djm at mindrot.org> ---
We don't planning on implementing any additional GSSAPI authentication
methods, sorry.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2495

--- Comment #3 from Andre Merzky <andre at merzky.net> ---
Hi Damien, may I ask for the reason of declining the patch?  I am
asking as a user which frequently has to deploy manually patched
versions of GSI-SSH, which is rather painful and not always possible. 
Is the patch itself problematic, or is it too difficult / involved to
review it?  Are you able to enumerate conditions which would allow an
acceptance of the patch?

Many thanks, Andre.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2495

--- Comment #4 from Damien Miller <djm at mindrot.org> ---
Hi Andre,

I declined it because we barely have the knowledge and environments
needed to maintain the existing GSSAPI code, and have no familiarity
with GSI nor means to test it.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2495

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #5 from Damien Miller <djm at mindrot.org> ---
closing resolved bugs as of 8.6p1 release

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.