Bug#765655: openssh: please clarify documentations for GSSAPI's cascading credential feature
Source: openssh
Version: 1:6.7p1-2
Severity: wishlist
Tags: patch
Hi Colin.
I would find the attached patch to be a useful addition
to the description of the two options regarding cascading
credentials in the manpages.
Could you please have a look at it and if you like it
merge it with your gssapi.patch?
Thanks,
Chris.
-- System Information:
Debian Release: jessie/sid
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Kernel: Linux 3.16-3-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_DE.utf8, LC_CTYPE=en_DE.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
diff -ru a/ssh_config.5 b/ssh_config.5
--- a/ssh_config.5 2014-10-17 04:00:23.207518014 +0200
+++ b/ssh_config.5 2014-10-17 04:01:20.234916507 +0200
@@ -725,10 +725,19 @@
If set to
.Dq yes
then renewal of the client's GSSAPI credentials will force the rekeying of the
-ssh connection. With a compatible server, this can delegate the renewed
+ssh connection. With a compatible server, this will delegate the renewed
credentials to a session on the server.
+.Pp
+Checks are made to ensure that credentials are only propagated when the new
+credentials match the old ones on the originating client and where the
+receiving server still has the old set in its cache.
+.Pp
The default is
.Dq no .
+.Pp
+For this to work
+.Cm GSSAPIKeyExchange
+needs to be enabled in the server and also used by the client.
.It Cm GSSAPITrustDns
Set to
.Dq yes to indicate that the DNS is trusted to securely canonicalize
diff -ru a/sshd_config.5 b/sshd_config.5
--- a/sshd_config.5 2014-10-17 04:00:23.211517971 +0200
+++ b/sshd_config.5 2014-10-17 04:01:20.482913890 +0200
@@ -561,6 +561,10 @@
successful connection rekeying. This option can be used to accepted renewed
or updated credentials from a compatible client. The default is
.Dq no .
+.Pp
+For this to work
+.Cm GSSAPIKeyExchange
+needs to be enabled in the server and also used by the client.
.It Cm HostbasedAuthentication
Specifies whether rhosts or /etc/hosts.equiv authentication together
with successful public key client host authentication is allowed
Reply to: