Bug 324

Summary:

privsep break KRB4 auth, KRB4 TGT forwarding and AFS token forwarding

Product:

Portable OpenSSH

Reporter:

Jan Iven <jan.iven>

Component:

sshd

Assignee:

OpenSSH Bugzilla mailing list <openssh-bugs>

Status:

CLOSED FIXED

Severity:

normal

Priority:

Version:

-current

Hardware:

All

OS:

All

Attachments:

Description	Flags
KRB4/KRB5/AFS with privsep	none
KRB4/5 auth with privsep	none
(fixing a "xfree" of an uninitialized buffer, in case KRB4 auth fails)	none

Description Jan Iven 2002-06-30 09:17:43 AEST

Since all of KRB4/KRB5 authentication (in protocol 1), TGT and AFS token
forwarding are priviledged operations, all fail with privsep.

The attached patch seems to fix this at least for KRB4 auth, KRB4 TGTs and AFS
tokens (cannot try KRB5 here).
Please review and consider for future inclusion.

Thanks,
Jan

Comment 1 Jan Iven 2002-06-30 09:19:56 AEST

Created attachment 125 [details]
KRB4/KRB5/AFS with privsep

Comment 2 Jan Iven 2002-07-03 19:56:04 AEST

Created attachment 128 [details]
KRB4/5 auth with privsep

Comment 3 Jan Iven 2002-07-03 19:57:56 AEST

(neither TGT forwarding nor AFS tokens needs privsep), reduced to just KRB4/5
auth. I suspect that KerberosPassword will be slightly broken since the ticket
file name does not go back to the session environment. To be confirmed, I am
using PAM now.

Comment 4 Jan Iven 2002-07-09 18:23:48 AEST

Created attachment 130 [details]
(fixing a "xfree" of an uninitialized buffer, in case KRB4 auth fails)

Comment 5 Darren Tucker 2003-08-26 17:47:57 AEST

KRB4 and AFS support has been dropped, and the KRB5 support has been overhauled.

Should this bug be closed?

Comment 6 Jan Iven 2003-08-26 18:07:04 AEST

Yes, this appears to be fixed (at least for Kerberos5). Since you have dropped
support for Kerberos4/AFS, I guess we will have to maintain the rest of it
ourselves, so it is no longer relevant to bugzilla..

Still, nice to see the GSSAPI stuff going in.

Comment 7 Damien Miller 2003-08-26 18:10:41 AEST

Yes, if I have time I will prepare a Krb4 patch around the time of the release.
An interested party is welcome to maintain this as a 3rd party patch

Comment 8 Damien Miller 2004-04-14 12:24:18 AEST

Mass change of RESOLVED bugs to CLOSED