openssh unix dev - May 2001 - OpenSSH 2.9p1 improperly caches username

Hi guys,

OpenSSH 2.9p1 using SSH2 currently caches the username sent in 
the USERAUTH_REQUEST [none] packet.  This does not allow you 
to change the username in a later authentication packet.     
     
>From SSH Authentication Protocol, section 2.1:
"The user name and service are repeated in every new 
authentication attempt, and MAY change.  The server implementation MUST
carefully check them in every message,
and MUST flush any accumulated authentication states if they change.  If it is
unable to flush some authentication
state, it MUST disconnect if the user or service name 
changes."
     
This behavior has been reported by users of SecureCRT attempting to change their
username during the SSH2 authentication process.
     
If you need any more information, please let me know.
     
-Daniel Prevett
 Van Dyke Technologies Support
 support at vandyke.com
 http://www.vandyke.com

On Wed, May 23, 2001 at 01:17:54PM -0600, Daniel Prevett
wrote:
> OpenSSH 2.9p1 using SSH2 currently caches the username sent in 
> the USERAUTH_REQUEST [none] packet.  This does not allow you 
> to change the username in a later authentication packet.     
>      
> >From SSH Authentication Protocol, section 2.1:
> 
> "The user name and service are repeated in every new 
> authentication attempt, and MAY change.  The server implementation MUST
> carefully check them in every message, 
> and MUST flush any accumulated authentication states if they change.
> If it is unable to flush some authentication
> state, it MUST disconnect if the user or service name 
> changes."
>
> This behavior has been reported by users of SecureCRT attempting to
> change their username during the SSH2 authentication process.
>      
> If you need any more information, please let me know.
openssh's behaviour is intentional. we don't want to allow
a change of user or service names. but we don't want to disconnect
(perhaps we should...).

there has been some discussion about this on the ietf-ssh at netbsd.org
list, but i don't remember the outcome of the discussion.

i'll look into this.