openssh unix dev - Mar 2004 - GSSAPI patch for multihomed hosts

Hi,

This is another attempt to get my gssapi for multi homed systems into
openssh. Please find attach a small change so that gssapi authentication
works on multihomed systems.

Regards
Markus
-------------- next part --------------
A non-text attachment was scrubbed...
Name: openssh-3.8p1-mm.diff
Type: application/octet-stream
Size: 3599 bytes
Desc: not available
Url :
http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20040324/41cbc9e0/attachment.obj

On Wed, Mar 24, 2004 at 12:34:23AM -0000, Markus Moeller
wrote:
> Hi,
> 
> This is another attempt to get my gssapi for multi homed systems into
> openssh. Please find attach a small change so that gssapi authentication
> works on multihomed systems.
I don't think this patch should be applied.  At least in the
(MIT|Heimdal) Kerberos case, it is better to simply pass GSS_C_NO_NAME
to gss_acquire_cred to accomplish the same thing.

More desirable IMHO is a patch for the client to use HostKeyAlias
to compute the GSSAPI name (so that tunneled SSH+GSSAPI connections
work).  I have something similar (but uses a different option name).
Due to compatiblity issues, I'm still on OpenSSH 3.6.1+GSSAPI patches,
but when I get a chance to migrate to 3.8 I will post patches here.

Cheers,
-- 
Jacques Vidrine / nectar at celabo.org / jvidrine at verio.net / nectar at
freebsd.org