Re: [saag] SSH Protocol Extensions

[Nico Williams <[e-mail]>]

On Wed, Aug 12, 2015 at 05:13:02PM +0100, Phil Lello wrote:
> On Wed, Aug 12, 2015 at 4:50 PM, Nico Williams <[e-mail]>
> wrote:
> > As for SSHv2 and federation, I'd like to understand what functionality
> > is needed that using GSS/ABFAB can't provide.
> >
> 
> I'm still getting up to speed on GSS/ABFAB, so reserve the right to reverse
> my position, however it seems to me that GSS/ABFAB is reasonably complex to
> implement, compared to defining a new authentication method. Whilst
> GSS/ABFAB seems well suited to large enterprise environments, I'm not
> convinced it is suitable for allowing federated identities to be used with
> light-weight stand-alone ssh servers. Admittedly, I'm currently put off by
> what appears to be a steep learning curve once GSS, RADIUS, et al. come
> into the mix, but with my 'lazy coder' hat on, it doesn't seem unreasonable
> that other potential implementers will feel the same.

If you ignore all of the details of the GSS-API for the moment and focus
just on the protocol, there's nothing complex.  It's a synchronous
exchange of opaque messages ("security context tokens") for some
mechanism.  You get to define these messages (unless ABFAB fits the
bill, then you can use ABFAB's).  You don't have to implement RFC2744
nor do you have to use existing implementations.  There's only one set
of bits-on-the-wire added by GSS, and that's on the first security
context token.

There are details of how to generate the mechanism name, but you don't
have to write code to do that.  You do it once, confirm that others get
the same result, and write down the results in your code.  There's also
a "MIC token" to bind the authentication to the SSHv2 key exchange.

That's it.  No need for GSS functions.  No need for a pluggable GSS
library.

"defining a new authentication method" seems unnecessary when there
already is one that can do what you want.

The complete specs are complex, of course, but that's only because they
deal with things that you don't have to.

Nico
--