Subject: RE: What do we want from sshv2?

From: Joe Salowey <[email-masked]>
Date: Mon, 30 Oct 2000 11:53:05 -0800

> > I was thinking mainly of credentials providing authorization to the
> > requested service.  The credentials are tied to the 
> principal identity
> > authenticated in the key exchange.  This may not be the 
> best place to send
> > this, but it is the only palce I could send it in the current
> > protocol.
> 
> Is there any reason you can't use yet another new userauth request
> type for that? I.e. first you send a SSH_USERAUTH_REQUEST
> "external-keyx", and next a SSH_USERAUTH_REQUEST
> "kerberos-extra-auth-whatever"? (You don't even have to wait for the
> reply to the first message, if you're concerned about roundtrips).
> 
> /Niels
In this case I am assuming the credential is only valid in the contect of
the original key exchange, so I thought let's just add the credential to the
SSH_USERAUTH_REQUEST "external-keyx".  I suppose there could be an
SSH_USERAUTH_REQUEST "external-keyx-additional-cred".  Is there a reason why
another userauth message should be used?

Joe

---

From: [email-masked] (Niels M�ller)
Date: 30 Oct 2000 21:46:35 +0100

> another userauth message should be used?

One of the ideas with the ssh userauth protocol, as I read it, is that
a server can require several userauth methods to succeed before
granting access (that's what the "partial success" flag is for. When
using this, the server is assumed to keep some state recording
previous partial successes, and forget the state whenever either of
the user name or service name changes.

It seems natural to me to use the same framework for the additional
credentials, i.e.

1. C->S: SSH_USERAUTH_REQUEST "nisse" "ssh-connection" "external-keyx"
2. S->C: SSH_USERAUTH_FAILURE "extra-credentials,publickey" true
3. C->S: SSH_USERAUTH_REQUEST "nisse" "ssh-connection" "extra-credentials" ...
4. S->C: SSH_USERAUTH_SUCCESS

NOTE: One can send (3) immediately after (1) if one wants to, without
waiting for the reply (2). And the string
"extra-credentials,publickey" in message (2) means that the server is
configured such that either providing extra-credentials, or performing
public-key authentication, may get the client closer to access.

But I may be missing something, as I don't know how the additional
credentials are supposed to work. For ticket forwarding services, it
seems more natural to do it as a GLOBAL_REQUEST or CHANNEL_REQUEST,
like for ssh agent-forwarding. As for x.509 certificates, I think one
should use the plain publickey userauth method (a certificate by
itself is quite useless, it must be accompanied by a proof of
possession of the corresponding private key).

/Niels