Subject: Re: WG Last Call (third time's the charm?) for SSH core drafts

From: Darren Moffat <[email-masked]>
Date: Mon, 4 Feb 2002 15:03:04 -0800 (PST)

>> Actually it might even be better to have it as a MUST since not doing
>> so allows for the potential of a client/server pair that can bypass admin
>> policy and we shouldn't really encourage that.
>
>Well, the password policy should be entirely enforced by the server.
>
>MUST would rule out a "soft password expiration" policy where the
>server could strongly suggest, but not require, a password change, for
>some time interval before the change became mandatory..

I was assuming that case would be dealt with by telling the user their
password was going to expire and letting them do the appropriate thing
for their system; however that might not be suitable in all cases so I
see that MUST is probably too strong.

--
Darren J Moffat

---

From: Darren Moffat <[email-masked]>
Date: Mon, 4 Feb 2002 15:07:44 -0800 (PST)

>We would probably need to reword as follows to get
>the strength you want (I'm okay with this.)
>
>   Normally, the server responds to this message with success or
>   failure.  However, if the password has expired the server SHOULD
>   indicate this by responding with SSH_MSG_USERAUTH_PASSWD_CHANGEREQ.
>   In anycase the server MUST NOT allow an expired password
>   to be used for authentication.
>
>     byte      SSH_MSG_USERAUTH_PASSWD_CHANGEREQ
>     string    prompt (ISO-10646 UTF-8)
>     string    language tag (as defined in [RFC1766])
>
>   In this case, the client MAY continue with a different
>   authentication method, or request a new password from
>   the user and retry password authentication using the
>   following message. The client MAY also send this message
>   instead of the normal password authentication request
>   without the server asking for it.

I like this wording but it does mean that Bill's "soft password expiration"
isn't workable with this.

Does anyone else care about this ?

>> Joseph, do you have this implemented on either side ?
>
>Yes.  Both sides.
>
>- Joseph

--
Darren J Moffat

---

From: Darren Moffat <[email-masked]>
Date: Tue, 5 Feb 2002 10:18:46 -0800 (PST)

>On Mon, 4 Feb 2002, Joseph Galbraith wrote:
>
>> I would say create a new working group
>> document for x.509 and remove it
>> from the transport draft.
>
>I support this approach. The current spec is too vague to implement.

I'm also in favour of removing it from core.

--
Darren J Moffat