Subject: [abfab] [Phil Lello] [saag] SSH Protocol Extensions

From: Sam Hartman <[email-masked]>
Date: Wed, 12 Aug 2015 12:01:24 -0400

This is out of scope for ABFAB but probably interesting to folks here.

Subject: [saag] SSH Protocol Extensions
From: Phil Lello <[email-masked]>
To: [email-masked]
Date: Wed, 12 Aug 2015 12:21:57 +0100
List-Id: Security Area Advisory Group <saag.ietf.org>

Hi,

I'm currently working on extensions to the SSH protocol; as I believe the
SecSH WG is effectively dormant, is this list the best place to discuss the
proposals?

Briefly, I am seeking to add support for federated/asserted identities to
SSH, for scenarios where the protocol is used as an application transport
(e.g. git, svn). This involves the client sending a desired username for
authentication, along with a authentication token from a trusted 3rd party.

In the initial implementation, this would be a SAML assertion, although I
intend to make the implementation generic enough to support other
mechanisms. Trust relationships for valid IdPs would be handled according
to local policy.

A related extension will be a formal websocket binding for SSH, and I
expect the reference implementation of this to be a patch to Gerrit (a
git-based code review tool that contains an embedded Java SSH server).

Phil Lello
_______________________________________________
saag mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/saag