Re: Support for multiple GSS libs

[Nicolas Williams <Nicolas.Williams@ubsw.com>]

Ah. But you still need the ability to select the mech at runtime -- by
that point only dlopen()/dlsym() at the app level or mechglue in the GSS
libs will help.

Q: Why prohibit the use of SPNEGO in SSH? Are there archives where the
   issue was discussed that I can read?

   Is it because, if GSS is selected, but the GSS mech negotiated by
   SPNEGO is not accpetable, then there is no way to go back and
   re-negotiate at the SSH level? Is there no way to go back and
   re-negotiate at the SSH level?

Cheers,

Nico


On Wed, Nov 07, 2001 at 05:40:26PM +0000, Simon Wilkinson wrote:
> On Wednesday 07 November 2001 17:30, Nicolas Williams wrote:
> > To negotiate which mech to use you'd need an SPNEGO implementation. And
> > the mechglue.
> 
> Not within the context of OpenSSH. The GSSAPI drafts for SSH specifically 
> prohibit the use of SPNEGO and instead mechanism negotiation is performed at 
> the same time as all other key exchange / user authentication negotiation, 
> within the SSH protocol.
> 
> S.
> 
> -- 
> Simon Wilkinson            <simon@sxw.org.uk>          http://www.sxw.org.uk
> "Do not meddle in the affairs of wizards, for you are crunchy and good with
> ketchup"
--
-DISCLAIMER: an automatically appended disclaimer may follow. By posting-
-to a public e-mail mailing list I hereby grant permission to distribute-
-and copy this message.-

Visit our website at http://www.ubswarburg.com

This message contains confidential information and is intended only 
for the individual named.  If you are not the named addressee you 
should not disseminate, distribute or copy this e-mail.  Please 
notify the sender immediately by e-mail if you have received this 
e-mail by mistake and delete this e-mail from your system.

E-mail transmission cannot be guaranteed to be secure or error-free 
as information could be intercepted, corrupted, lost, destroyed, 
arrive late or incomplete, or contain viruses.  The sender therefore 
does not accept liability for any errors or omissions in the contents 
of this message which arise as a result of e-mail transmission.  If 
verification is required please request a hard-copy version.  This 
message is provided for informational purposes and should not be 
construed as a solicitation or offer to buy or sell any securities or 
related financial instruments.