This is a minimal patch implementing GSSAPI key exchange. It implements the group1, group14 and group exchange mechanisms as detailed in RFC4426. As I've noted in the past, key exchange is useful for large sites who don't want the additional overhead of maintaining ssh known hosts files when they already have a deployed key management architecture Please consider this patch for future inclusion in OpenSSH - as I'm sure you're aware, it's been in widespread use for a number of years now, and many other vendors have developed their GSSAPI key exchange implementations against it. As always, I'm happy to provide whatever help may be required to get this into the tree.
Created attachment 1195 [details] Patch to add GSSAPI Key Exchange support
At our institution machines are SA'd by many, many organizations and there is simply no way to coordinate a useful known_hosts file. OTOH we have a nicely centralized Kerberos infrastructure so widespread use of these patches solves the problem nicely. Since these patches are already included in most OS's, it would be nice for the community to converge OpenSSH and RedHat with the rest of the community. It would reduce our overhead in supporting the few odd exceptions.
Any chance getting this into 4.9?
I would also like to see this patch mainstreamed.
Is there any chance to get some definitive yes/no on this feature from OpenSSH developers? (preferably with some reasoning)
Created attachment 1664 [details] Patch to add GSSAPI Key Exchange support This updates this patch to OpenSSH 5.2p1, and includes some minor fixes suggested by Greg Hudson during a code review he did for the MIT Kerberos Consortium.
None of the OpenSSH developers are in favour of adding this, and this situation has not changed for several years. This is not a slight on Simon's patch, which is of fine quality, but just that a) we don't trust GSSAPI implementations that much and b) we don't like adding new KEX since they are pre-auth attack surface. This one is particularly scary, since it requires hooks out to typically root-owned system resources.
Mass move of bugs RESOLVED->CLOSED following the release of openssh-5.5p1