[2303] in athena10
Re: [Debathena] #205: ssh changes behavior from Athena 9,
daemon@ATHENA.MIT.EDU (Debathena Trac)
Wed Apr 15 21:12:01 2009
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
From: "Debathena Trac" <debathena@MIT.EDU>
Cc: debathena@mit.edu
To: jmorzins@mit.edu, andersk@mit.edu, jdreed@mit.edu
Date: Thu, 16 Apr 2009 01:11:43 -0000
Reply-To:
Message-ID: <054.8741c443e78436b24f68f731b07a6592@mit.edu>
In-Reply-To: <045.dc406a80e7544701121648e9f5b55df5@mit.edu>
Content-Transfer-Encoding: 8bit
#205: ssh changes behavior from Athena 9, does not delegate tickets by default-------------------------+--------------------------------------------------
Reporter: jmorzins | Owner:
Type: defect | Status: new
Priority: major | Component: --
Keywords: ssh kerberos |
-------------------------+--------------------------------------------------
Comment(by jdreed):
Replying to [comment:4 andersk]:
>> Kerberos Extras does this for you on Mac OS X too.
>
> Really? That seems extremely poor, especially since I don’t see any
documentation for that change, at least on their
> website. I agree we should get macdev to comment on this.
http://web.mit.edu/macdev/KfM/Common/Documentation/osx-kerberos-
extras.html says "In addition the Mac OS X 10.4 (Tiger) and 10.5 (Leopard)
Kerberos Extras will also modify your ssh configuration to allow the use
of Kerberos by default. Apple disabled Kerberized ssh in 10.4.9 (Tiger) by
default to solve performance problems on networks without DNS."
and I have /etc/ssh_config.backup.1 correspdoning the date I installed
Kerberos Extras (based on the package receipt), and /etc/ssh_config says:
{{{
# System-wide defaults set by MIT Kerberos Extras
Host *
GSSAPIAuthentication yes
GSSAPIDelegateCredentials yes
GSSAPIKeyExchange yes
}}}
>> Given that the dialups will be Athena 9 for quite a while, if enabling
this is not possible, I'd really like to configure -cluster
>> and -workstation to at least delegate credentials to the Athena
dialups. If those are compromised, we're pretty doomed
>> anyway, so I think it's reasonable to trust them.
>
> For -cluster and -workstation, I would be open to considering this, but
I worry that the inconsistency (between -standard
> and -cluster, as well as between athena.dialup and other hosts) may be
just as confusing as the difference from Athena 9
>in the first place.
Given that it will have a fixed time period, we could bill it as a
transition feature, so I'm not too concerned about the consistency. Once
we have a date for the transition of athena.dialup to Linux, we can
explicitly say we will desupport this feature on that date, and users will
then have to use ssh -K regardless.
-- Ticket URL: <http://debathena.mit.edu/trac/ticket/205#comment:5>Debathena <http://debathena.mit.edu/>MIT Debathena Project
