Re: [saag] SSH Protocol Extensions

[Phil Lello <[e-mail]>]

On Wed, Aug 12, 2015 at 4:50 PM, Nico Williams <[e-mail]>
wrote:

> On Wed, Aug 12, 2015 at 10:57:16AM -0400, Michael Richardson wrote:
> >
> > Phil Lello <[e-mail]> wrote:
> >     > Many thanks Stefan, I wasn't aware of the ABFAB WG, I will review
> their
> >     > specs.
> >
> > Is ABFAB actually writing SSH extensions?
>
> No, they aren't.
>
> > My (three-minute review) impression they are writing GSSAPI extensions,
> and
> > SSH can use GSSAPI.
>
> Yes, that's it.
>
> > If they don't suit, where would Phil go?
>
> In principle the old SECSH WG mailing list is to be used for discussing
> SSHv2 extensions.  We might want to create an @ietf.org list though,
> though if the volume is low enough SAAG works for me.
>

As for SSHv2 and federation, I'd like to understand what functionality
> is needed that using GSS/ABFAB can't provide.
>

I'm still getting up to speed on GSS/ABFAB, so reserve the right to reverse
my position, however it seems to me that GSS/ABFAB is reasonably complex to
implement, compared to defining a new authentication method. Whilst
GSS/ABFAB seems well suited to large enterprise environments, I'm not
convinced it is suitable for allowing federated identities to be used with
light-weight stand-alone ssh servers. Admittedly, I'm currently put off by
what appears to be a steep learning curve once GSS, RADIUS, et al. come
into the mix, but with my 'lazy coder' hat on, it doesn't seem unreasonable
that other potential implementers will feel the same.

> I think it would have to be an Independant Stream or AD sponsored, but I'm
> > sure that using saag to review would be great.
>
> Yes.
>
> > It would be very nice to be able to get a list of names of the server
> > that are "also" names... and it would be nice to be able to get a
> 302-type
> > redirect...
>
> Hmm?  You mean ask an SSHv2 server to list its aliases?  And to give you
> temporary redirects?
>
> I'm not sure I understand the reason for this, but wouldn't reverse DNS on
the target hostname achieve this?


> Nico
> --
>

Phil