Re: [Isms] ssh authn

["David Harrington" <ietfdbh at comcast.net>]

sentence 1 talks about server authn, which I assume means RFC4253.
sentences 2-4 talk about user authn, which I assume means RFC4252
sentence 5 talks about server authn, which I assume means RFC4253.

It strikes me that this paragraph should be reworked to separate the
server auth and the user auth discussions.

Unless, of course, I am misunderstanding this text.
Maybe this is about how to use tmTransportAddress during server authn,
and it just is not clear.

is this all about server authn, or is client and server authn mixed in
this paragraph?

dbh

> -----Original Message-----
> From: Juergen Schoenwaelder 
> [mailto:j.schoenwaelder at jacobs-university.de] 
> Sent: Thursday, January 22, 2009 2:47 PM
> To: David Harrington
> Cc: isms at ietf.org
> Subject: Re: [Isms] ssh authn
> 
> On Wed, Jan 21, 2009 at 11:19:16AM -0500, David Harrington wrote:
> > In the following paragraph, is this all about server authn, or is
> > client and server authn mixed into this paragraph?
> > 
> > Using tmTransportAddress, the client will establish an
> >         SSH transport connection using the SSH transport protocol,
> >         authenticate the server, and exchange keys for message
> >         integrity and encryption. The tmTransportAddress field may
> >         contain a user-name followed by an '@' character 
> (ASCII 0x40)
> >         that will indicate a specific user-name string that 
> should be
> >         presented to the ssh server as the "user name" for
> >         authentication purposes. This MAY be different than 
> the passed
> >         tmSecurityName value that will be used in the 
> remaining steps
> >         below. If there is no specified user-name in the
> >         tmTransportAddress then the tmSecurityName should be used
> >         as the user-name. The other parameters of the transport
> >         connection and the credentials used to authenticate the
> >         server are provided in an implementation-dependent manner.
> 
> I am not sure where your question is supposed to leads to. The text
> tells me that the user-name portion of the tmTransportAddress if
> present is used as the ssh user name instead of tmSecurityName.  The
> user name is relevant for SSH client authentication, not for SSH
> server authentication. That said, I am still wondering what the
reason
> behind your question is...
> 
> /js
> 
> -- 
> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
> Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
> 

_______________________________________________
Isms mailing list
Isms at ietf.org
https://www.ietf.org/mailman/listinfo/isms