GSSAPI Key Exchange on multi-homed host

2008-10-14 Thread petesea
>From a security standpoint, if the default keytab (/etc/krb5.keytab) contains only ONE principal, does it matter if GSSAPIStrictAcceptorCheck is set to "yes" or "no"? My company uses an internally built OpenSSH package that includes the GSSAPI Key Exchange patch. Because we have 1000s of host

Re: Kerberize MS Exchange?

2008-10-14 Thread Luke Scharf
Markus Moeller wrote: I can also confirm that outgoing SMTP with GSSAPI auth works with Thunderbird against sendmail. Is there a GUI-switch to turn GSSAPI authentication on for SMTP? (It's quite possible that I missed it, or that the good folks who built Thunderbird for my distribution fo

Re: Kerberize MS Exchange?

2008-10-14 Thread Simon Wilkinson
On 14 Oct 2008, at 23:21, Markus Moeller wrote: > I can also confirm that outgoing SMTP with GSSAPI auth works with > Thunderbird against sendmail. If anyone is having problems with GSSAPI and Thunderbird which they believe is a bug in the product, please open a bug in their Bugzilla and Cc:

Re: Kerberize MS Exchange?

2008-10-14 Thread Markus Moeller
I can also confirm that outgoing SMTP with GSSAPI auth works with Thunderbird against sendmail. Markus "Luke Scharf" <[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED] >Victor Sudakov wrote: >> Is there anyone for whom Thunderbird with GSSAPI really works? >> I hope it is not just theo

Re: Kerberize MS Exchange?

2008-10-14 Thread Edward Murrell
Yep, also confirmed to work with Dovecot IMAP server. > Victor Sudakov wrote: > Is there anyone for whom Thunderbird with GSSAPI really works? > I hope it is not just theory, someone is using it or has tested it? > > -- > Victor Sudakov, VAS4-RIPE, VAS47-RIPN > 2:5005/[EMAIL PROTECTED] http://vas

Re: Kerberize MS Exchange?

2008-10-14 Thread Luke Scharf
Victor Sudakov wrote: Is there anyone for whom Thunderbird with GSSAPI really works? I hope it is not just theory, someone is using it or has tested it? I use Thunderbird with GSSAPI with Dovecot on my home-network. It works nicely. The only weird thing was that they used the term "Secure

Re: Kerberize MS Exchange?

2008-10-14 Thread Victor Sudakov
Victor Sudakov wrote: > > > > > >> Incidentally, I have been informed off-list that newer versions of > > >> Exchange's IMAP implementation actually do support Kerberos via > > >> GSSAPI. > > > > > > And what win32 IMAP clients can authenticate with GSSAPI? > > Thunderbird is reported to be able

Re: Kerberize MS Exchange?

2008-10-14 Thread Markus Moeller
I use it against Cyrus IMAP v2.3.12p2 server (both client and server on Linux) with AD as kdc. * OK [CAPABILITY IMAP4 IMAP4rev1 LITERAL+ ID STARTTLS AUTH=DIGEST-MD5 AUTH=PLAIN AUTH=GSSAPI AUTH=CRAM-MD5 SASL-IR] imap.server.home Cyrus IMAP v2.3.12p2 server ready 1 capability * CAPABILITY IMAP4 I

Re: Kerberize MS Exchange?

2008-10-14 Thread Markus Moeller
Victor, I can also confirm that Thunderbird works with GSSAPI/SSPI on XP against the Cyrus IMAP server. ( I just downloaded Thunderbird and did not modify any settings other then adding the account details) Markus "Markus Moeller" <[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED] >I