Opened 10 years ago
Last modified 7 years ago
#10266 new Patch
Implementation of Kerberos/GSSAPI support (RFC 2228)
| Reported by: | Ken Hornstein | Owned by: | |
|---|---|---|---|
| Priority: | normal | Component: | FileZilla Client |
| Keywords: | Cc: | ||
| Component version: | Operating system type: | ||
| Operating system version: |
Description (last modified by )
I've implemented Kerberos/GSSAPI support (RFC 2228) for the FileZilla client. I've made sure my changes work against the most recent source code of FileZilla. I've tested this on MacOS X and Windows, and I believe there should be no problems having it work on Linux.
I'd like to get this into the FileZilla source code. So ... what do I need to do to make this happen? Should I just post the patch here?
Attachments (1)
Change History (8)
comment:1 by , 10 years ago
| Status: | new → moreinfo |
|---|
comment:2 by , 10 years ago
| Status: | moreinfo → new |
|---|
Okay, it's been attached to this ticket. A few changes for building on Windows with MinGW have been included, but those should be obvious.
comment:3 by , 8 years ago
Is there any possibility of getting these features included in FileZilla?
I work at a national laboratory that uses Kerberos heavily, and there is a serious lack of third-party support on Windows. Only one major SFTP GUI can use Kerberos authentication (rhymes with "ShminSCP") and it's barely functional in general.
I know that many years ago, Kerberos support was removed due to the lack of a testing environment. Perhaps the FileZilla developers can contact the kfwdev list (https://web.mit.edu/kerberos/contact.html) to establish such a test setup. There are many Windows users who would greatly appreciate being able to use FileZilla with Kerberos.
follow-up: 6 comment:4 by , 7 years ago
| Description: | modified (diff) |
|---|---|
| Status: | new → moreinfo |
Please use FTP over TLS with password authentication. It's perfectly secure and MANY MANY MANY orders of magnitude easier to use than this GSS kludge. It's also much faster.
For this patch to be eligible I require instructions how to properly setup GSS infrastructure within 5 minutes on a standard Debian machine.
comment:5 by , 7 years ago
Is this sufficient? Installing Kerberos on Debian
(I've been pleading with the lab's IT department for years to ditch Kerberos; however, user support is not their priority.)
comment:6 by , 7 years ago
| Status: | moreinfo → new |
|---|
Replying to codesquid:
Please use FTP over TLS with password authentication. It's perfectly secure and MANY MANY MANY orders of magnitude easier to use than this GSS kludge. It's also much faster.
I'm sorry, this statement is ... not accurate.
Well, okay, let me expand on that. FTP over TLS is fine, as long as you don't have a Kerberos environment. If you do, then it is MUCH LESS SECURE. As for orders of magnitude easier to use, I cannot agree. Also, I disagree completely that it is a kludge. As for speed, I did testing here and the speed was fine.
For this patch to be eligible I require instructions how to properly setup GSS infrastructure within 5 minutes on a standard Debian machine.
You know, first the complaint was, "Nobody has written the code". Now the complaint is, "I can't test it". I have to say that it sure feels like you're moving the goalposts on me. And it sure would have been nice to know that the goalposts were moved on me 2 years ago.
If the issue REALLY IS "I can't test it", I'm willing to work with you guys on that. I just don't want another issue to appear later. But "setup within 5 minutes" seems kind of arbitrary and capricious. The advantage to Kerberos is it's a centrally-managed key distribution system; the disadvantage is, that requires some infrastructure, and some extra pieces. It has it's place, just like TLS does.
Look, I would like this integrated. I'm willing to meet you more than halfway on this. You don't need any software that doesn't already ship with popular Linux distributions. If the issue really is getting a simple Kerberos infrastructure up, that could be easily made scriptable. I can help with that. It is not rocket science, but it's easy to get it wrong and the solution to errors you get is not obvious unless you have experience with Kerberos. I'm glad to help you get it working.
comment:7 by , 7 years ago
Replying to kenh:
I've implemented Kerberos/GSSAPI support (RFC 2228) for the FileZilla client. I've made sure my changes work against the most recent source code of FileZilla. I've tested this on MacOS X and Windows, and I believe there should be no problems having it work on Linux.
Nice! Thank you so much for that!
I'd also love to see this upstream and in the official FileZilla builds.
Do you happen to have a more recent version of the patch that applies to the most recent sources in svn or to the latest release? If so, I would really appreciate if you could post it here.
Anyway, thank you very much kenh!
Yes, please post the patch here as unified context diff against the current trunk HEAD of the FileZilla SVN repository.