[2330] in Kerberos
Summary: DEC Ultrix kerberos
daemon@ATHENA.MIT.EDU (USA::JMA21624)
Mon Nov 2 10:40:33 1992
Date: 2 Nov 92 10:11:00 EST
From: "USA::JMA21624" <JMA21624%USA.decnet@usav01.glaxo.com>
To: "kerberos" <kerberos@MIT.EDU>
After talking with DEC Support and another very helpful DEC person in
the Athena group, we decided that in order to use the MIT kerberized
"r" commands, we would have to abandon DEC Ultrix kerberos.
As I understand DEC Ultrix kerberos, it does not perform user
authentication; the named/Hesiod service has been kerberized to provide
user authentication. For this reason, and those listed below, we felt
that DEC Ultrix kerberos would be inappropriate in a heterogeneous
environment where other machines will be running MIT kerberos.
This was disappointing, but it turns out that it is no big deal. We
compiled MIT K4 on Ultrix with no trouble at all, and, in our spare
time, we are testing it. So far, we find it to do exactly what we want.
Here is a summary of the differences between DEC Ultrix kerberos and
MIT kerberos, as described to us (I have not verified any of this):
DEC does not support DEC Ultrix Kerberos in the same environment with
MIT kerberos.
DEC Ultrix kerberos uses the MIT KV4 network protocol for client ticket
requests from the Kerberos server (both TGT and application tickets).
DEC Ultrix kerberos uses the same encryption and string-to-key
algorithms as MIT KV4.
The DEC ULTRIX kerberos kinit will work with an MIT-based Kerberos server,
and vice versa.
DEC ULTRIX kerberos does not provide library functions to perform raw
end-to-end encryption (pcbc_encrypt() etc.). Routines that do encryption
have the algorithms in-lined (thus avoiding export restricitons).
DEC ULTRIX kerberos does not provide the krb_mk_priv() and krb_rd_priv()
routines (no encrypted sessions... avoids export restrictions).
The ULTRIX versions of kprop and kpropd use safe mode by default and don't
provide the private mode which MIT uses by default (due to export issues).
ULTRIX uses the principal name "kprop" for authentication, while MIT
uses "rcmd" by default."
the ULTRIX Kerberos library contains a typecasting bug that was fixed in
the MIT code, having to do with obtaining TGTs with a lifetime value of
128 (10 hours 40 minutes) or greater.
