[23509] in Kerberos
Re: Kerberos without DNS
daemon@ATHENA.MIT.EDU (Ken Raeburn)
Fri Mar 11 10:53:22 2005
In-Reply-To: <1110514330.343870.113460@g14g2000cwa.googlegroups.com>
Mime-Version: 1.0 (Apple Message framework v619.2)
Content-Type: text/plain; charset=US-ASCII; format=flowed
Message-Id: <19f375915db9c55dc7d9b1adc0c454b3@mit.edu>
Content-Transfer-Encoding: 7bit
From: Ken Raeburn <raeburn@mit.edu>
Date: Fri, 11 Mar 2005 09:42:06 -0600
To: sureshjayaram@gmail.com
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
On Mar 10, 2005, at 22:12, sureshjayaram@gmail.com wrote:
> Managed to setup Kerberos without DNS server. Things to remember..
>
> (i) Have entries in /etc/hosts for all the machines, KDC server &
> kerberized server/client, so that the hostname is resolvable
Yup. Note too that the entries must agree on what the first-listed
name is, though I've seen some systems that prefer using the FQDN and
some that use just the first component.
> (ii) Principals will be of the format <user>/host@REALM instead of
> <user>/host.domain@REALM
Only if /etc/hosts lists the unqualified name first. Note that this
won't be compatible with usage in a DNS environment, as it's not
actually compliant with the specification (which says you use the
FQDN).
(And, actually, I thought at one point I'd put together some code for
looking at the second returned name if the first had no dots in it, but
maybe I didn't check it in, or maybe you're listing only one host
name.)
> (iv) This method doesn't scale
True.
Ken
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
