Changes between Initial Version and Version 1 of Ticket #64748, comment 16


Ignore:
Timestamp:
Mar 8, 2022, 9:32:52 PM (3 years ago)
Author:
artkiver (グレェ)
Comment:

Legend:

Unmodified
Added
Removed
Modified
  • Ticket #64748, comment 16

    initial v1  
    33Alas, I am probably not the right person to attempt to refactor the GSSAPI/gsskex patch at this moment. While I have certainly used OpenSSH with things such as DuoSec tokens, OATH-TOTP (using Google Authenticator tokens), yubico tokens (e.g. the yubico-pam MacPort) and even RSA SecurID tokens (via lib-pam-radius-auth some years ago) and I think Bob Beck's work with utilizing kerberos and OpenBSD for ethernet authentication to provide something not entirely dissimilar to 802.1X port level authentication using libre/free open source software (I think he may have even later iterated that to use authpf?) as cited here: https://cvs.afresh1.com/~andrew/o/events.html#lisa99 I personally, do not have any GSSAPI infrastructure against which I can test even the previous version of the patch.
    44
    5 Moreover, based upon the, IMHO, rather strong cautionary language of why the upstream OpenSSH project, did not merge the https://github.com/openssh-gsskex patches, as well as the fact that they themselves do not appear to have updated their codebase in several months, as well as my general tendency to reduce dependencies and attack surfaces and thus my own personal choice in using the OpenSSH port is to -kerberos5 -gsskex -authx variants for example, I am probably not really of the general mindset even think that refactoring the previous patch for the current version of OpenSSH is a wise idea without a lot more convincing, and given that my interest in updating the port was predominantly to keep it in alignment with the openssh.com current release, and I am merely a volunteer without commit access, I would encourage you to seek out other guidance since I doubt I will be able to be of much additional assistance given my present circumstances.
     5Moreover, based upon the, IMHO, rather strong cautionary language of why the upstream OpenSSH project, did not merge the https://github.com/openssh-gsskex patches, as well as the fact that they themselves do not appear to have updated their codebase in several months, as well as my general tendency to reduce dependencies and attack surfaces and thus my own personal choice in using the OpenSSH port is to -kerberos5 -gsskex -xauth variants for example, I am probably not really of the general mindset even think that refactoring the previous patch for the current version of OpenSSH is a wise idea without a lot more convincing, and given that my interest in updating the port was predominantly to keep it in alignment with the openssh.com current release, and I am merely a volunteer without commit access, I would encourage you to seek out other guidance since I doubt I will be able to be of much additional assistance given my present circumstances.
    66
    77If you want to see this patch updated, I would suggest maybe reaching out to individuals who did work on previous iterations might be a better approach, such as found in https://trac.macports.org/ticket/27250 or https://trac.macports.org/ticket/60959 ?