search for: smichaud

...I code Product: Portable OpenSSH Version: -current Platform: All OS/Version: All Status: NEW Severity: normal Priority: P2 Component: Kerberos support AssignedTo: openssh-bugs at mindrot.org ReportedBy: smichaud at pobox.com This is something we missed when going over the GSSAPI code this August. The code in ssh_gssapi_krb5_storecreds() in gss-serv-krb5.c doesn't set the KRB5CCNAME environment variable correctly. At present it includes only the cache's "name". But it should actually...

I haven't (yet) tried your patch, but here's some information you may find useful: There exists a "krbafs" library, which is in effect a port of KTH Kerberos's libkafs to MIT Kerberos V (http://web.mit.edu/openafs/krbafs/). But KTH-krb is (of course) a clone of Kerberos 4, so libkrbafs requires Kerberos 4 credentials. (I've only built krbafs on OS X, and its "home

As far as I know this patch has no security implications -- I don't believe that allowing sshd to use get_local_name() (in canohost.c) on a connected socket to determine it's own fqdn will allow a malicious client (or router or dns server) to make it come to the wrong conclusion. But please let me know if you think I'm wrong. Please also let me know if you're just not interested

As many of you know, OpenSSH 3.7.X, unlike previous versions, makes PAM authentication take place in a separate process or thread (launched from sshpam_init_ctx() in auth-pam.c). By default (if you don't define USE_POSIX_THREADS) the code "fork"s a separate process. Or if you define USE_POSIX_THREADS it will create a new thread (a second one, in addition to the primary thread). The