Auth selection | SecurID | scp + sftp logging | GSSAPI/SSPI for PuTTY

Auth selection

This patch allows to specify AllowUsers, DenyUsers for individual authentications (hostbased, publickey, password, keyboard-interactive, kerberos, kerberos_or_local, gss, securid-1@ssh.com). This enables you to configure authentication methods for each user. It is designed for SSH2.

All configuration options are mentioned in file sshd_config. Their usage is the same like with AllowUsers, DenyUsers.

SecurID support for OpenSSH

SecurID authentication for OpenSSH is done as a patch for the official portable release of OpenSSH. It is done as challenge response authentication and securid-1@ssh.com authentication (a non-standard solution provided in commercial implementations from F-Secure and SSH).

Features:

all SecurID token states are covered (Next token code and New PIN)
implemented as challenge response authentication
securid-1@ssh.com authentication supported on server and client side - note: !! this authentication is available only in patch for 3.7.1p2 version !!
user sees the prompts according to the token state
privilege separation is fully supported
support for shared login
option for negation of content securid_users file (only 3.9p1 patch)

Shared login

is implemented for SecurID challenge response authentication
you can configure that real users (owners of SecurID token) can authenticate as "pseudo" users (generally we can say that these are users who can't be assigned a SecurID token: root, oracle, ...)
configuration is described in README.SecurID

Patch:

On net you can find another (different) implementation, which make possible use of SecurID tokens in OpenSSH. But this is very simple solution in my opinion. This is implement as hack into Password authentication.

Comparison of patches
	This patch	Theo's patch
Token states support
normal	yes	yes
Next Tokencode	yes	yes / not usable
New PIN	yes	no
Token states and their prompts
normal	Enter PASSCODE:	if you connect to remote host you see only password prompt and you must know if enter password or PASSCODE
Next Tokencode	Wait until the Tokencode changes, ...	you have no chance how to detect this state yourself; when you connect to host, admin of this host must look into syslog or ACE/Server admin into activity report
New PIN	New PIN required; do you wish to continue ...	n/a

scp + sftp logging

This patch is based on sftplogging patch, with small modifications and mainly scp logging is added. You must apply both previous patches before applying this one.

Patch:

GSSAPI/SSPI for PuTTY

This patch adds support for GSSAPI/SSPI (Kerberos 5) authentication into PuTTY.

GSSAPI:

GSSAPI code is based on OpenSSH 3.8p1.
Tested with MIT Kerberos for Windows (available here: http://web.mit.edu/kerberos/www/dist/index.html).
Works on Linux.
All libraries are loaded dynamically, no libraries are needed for compilation and running. However, for using GSSAPI authentication in PuTTY, Kerberos libraries must be present of course.

SSPI:

SSPI code is based on gssklog 0.11 from Doug Engert.
This authentication works on Windows 2000 and higher. PuTTY as such works on all supported Win platforms.

Patch:

Compiled (for Windows):

Comments, objections, suggestions: v_t_m /*at*/ seznam /*dot*/ cz