Tom Yu MIT Room E40-342 77 Massachusetts Avenue Cambridge, MA 02139 Tel: (617)253-8085 Kerberos V5 Authentication of X Connections Traditional Kerberos client-server authentication requires that each application have a private server key. In the Athena environment at MIT, public workstations have a well-known root password, and the secure storage of a private server key would not be feasable. Hence, extensions to X11 for using Kerberos authentication have not been undertaken. With the advent of Kerberos V5, user-to-user authentication allows for authentication without the use of a private server key on the server, provided that the server has access to a user's ticket-granting-ticket. The X server on a public Athena workstation runs as root, and therefore it is possible for it to obtain the user's ticket-granting-ticket and authenticate an X connection without requiring the storage of a private server key on the server. Implemenation of this authorization scheme was a challenging task, since the nature of the scheme used in the X protocol prior to X11R6 only provided for a single exchange of packets before the actual X connection became established. In the old protocol, the client sends a single packet to the server, which then uses the data to determine whether the client is authorized to connect to it. The server then sends back either a rejection or a success notification to the client. Due to the extra packet exchanges needed for user-to-user authentication, this existing minor exchange of packets is insufficient, and consequently we implemented an extension to the connection opening protocol. We split the connection opening sequence into two parts: the first calls the authorization protocol and the second sends the success or failure notice to the client. The first part of the connection opening sequence will usually call the second, except for when protocols such as our Kerberos V5 extension are used. Splitting the connection code in this way allows authorization protocols to have multiple packet exchanges before completing the connection with the client. Original concept Ralph Swick and Don Davis. Design and implementation by Tom Yu. Thanks to Ted Ts'o, Bob Scheifler, and Stephen Gildea for assistance in design and implementation. This project was done under the auspices of MIT UROP (Undergraduate Research Opportunities Program).