Subject: Telnet GSSAPI Authentication was Re: LIKPEY issues (was Re: host based principal names) from CAT-WG mailing list

From: Jeffrey Altman <[email-masked]>
Date: Tue, 25 Apr 2000 14:56:34 EDT

> I agree, and _if_ we had a GSS-API authentication mechanism for telnet,
> I would say that the only target name that should be tried would be
> "[email-masked]".
> 
> (If there was going to be GSSAPI versions of telnet and rlogin, I
> think everyone would agree they would all use "[email-masked]" as a
> service name).

I would agree.  Although we may not have the ability to make the
choice.  The Microsoft NT Services for Unix (SFU) group that is
responsible for the Telnet implementation Windows 2000 has a problem.
Their Telnet Server does not implement the AUTH KERBEROS_V5 option
because it is incompatible with their Kerberos SSPI.  When Windows
2000 is configured to use KERBEROS_V only it disables the only
authentication method (NTLM) which is supported by the Telnet Server.
This forces users to type plaintext usernames and passwords.

It is my belief that if the SFU group decides to rectify this problem
they will do so by creating a Telnet AUTH GSSAPI-KERBEROS_V method
that uses the service name "telnet" and not "host".  I have tried to
contact Microsoft to find out what they plan to do but have not
received any replies.

In the past I have argued against the implememtation of a GSSAPI 
Telnet AUTH method on the grounds that it is not needed and the 
extra overhead of wrapping GSS around other protocols within a
Telnet AUTH negotiation is unwarranted.  But given the inability 
of using the traditional KERBEROS_V5 authentication method with
Windows 2000, perhaps it has become necessary to define such a 
standard to head off the implementation of a KERBEROS_5 SSPI specific
method; or the use of service names which we would disagree with.

Anyone have an opinion on this matter?

    Jeffrey Altman * Sr.Software Designer * Kermit-95 for Win32 and OS/2
                 The Kermit Project * Columbia University
              612 West 115th St #716 * New York, NY * 10025
  http://www.kermit-project.org/k95.html * [email-masked]

-++**==--++**==--++**==--++**==--++**==--++**==--++**==
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: Ken Hornstein <[email-masked]>
Date: Tue, 25 Apr 2000 15:37:37 -0400

>Anyone have an opinion on this matter?

1) Fix the dang Windows 2K SSPI (besides ... I thought that the Kerberos
   change password protocol uses raw Kerberos, and aren't they doing that?)

2) If 1) isn't possible, then use "host" as the service name!!

--Ken