[2513] in Kerberos
No subject found in mail header
daemon@ATHENA.MIT.EDU (Glenn NoI Machin)
Fri Jan 15 18:47:26 1993
Date: Fri, 15 Jan 93 16:20:19 MST
From: gmachin@somnet.sandia.gov (Glenn NoI Machin)
To: kerberos@MIT.EDU
We would like to know who is working with Version 5 (MIT) of kerberos?
We have just finished placing out in our production environment
kerberos version5 with supported application of:
telnet/telnetd
kftp/kftpd (ftp but only accepts kerberos tickets)
rsuite (rlogin/krlogind rsh/krshd rcp) (rcp -x does not work)
NQS
nfsid (version 4 client authentication program for NFS)
(plus other assorted applications such as tdset for syncing time)
We have ported to :
Convex ConvexOS 10.0
HP 9000/700 8.0
HP 9000/300 8.0
HP 9000/300 7.0
Sun4/Sun4 SunOs 4.0
Vax Ultrix 4.2
Silicon Graphics Irix 4.0
Mips umips 4.5
IBM AIX 3.2
MacIntosh AUX 2.0
Unicos 6.1,7.0
A summary of how this code differs from MIT is:
KDC - Can do Hardware authentication with SecurID cards.
( Must have ACE server and link it some libraries into the KDC.)
Will handle both v4/v5 requests.
Does blacklisting (modifies database). This can be turned off
dynamically through a parameter file which the KDC reads on
startup. Other parameters are handled dynamically also.
Full kdb5_edit functions.
(Database maintains principal)
libkrb5 - routines which will forward tgt via authorization field
of service tickets. No modification of application protocol
to pass tgt, as suggested in MIT rlogin. See notes on telnetd.
kadmin/kadmind - Acl determines who can do what (works)
kinit - Can do SecurID authentication, renew tickets in the ticket cache.
kpasswd/kadmind - provides machine generated passwords ( I know you really
want this....)
ksu and ksrvtgt - available
Applications:
telnet/telnetd : Telnet has option -f which will forward ticket to
destination, provided user performed kinit -f. Also
will look for environment variable KRB5_AUTOFORWARD.
Telnetd can setup ticket cache for user who forwarded
tgt. Uses login -r or login -f if available(hpux 8.0 and
aix are the only ones that I know who have login -f) to
auto-login after authentication. Telnetd can force
encrypted session (-E option), and user can't change it.
-a [user,valid,none,etc do something]
-OWS can force kerberos authentication for all except
systems listed in /etc/ows.
NOTE: required increase in subnegotiation buffers to
increased ticket size, when forwarding was done.
rlogin/krlogind : Can ticket forward, setup cache like telnet/telnetd above.
NQS : Does version4 or version5 authentication.
Kftp/kftpd : available.
nfsid : available.
We would be happy to share this with anyone (MIT has got a copy: we still
need to send some updates)
We also (and I know this is not advisable) have binaries with installation
scripts to setup the KDC and clients, for those who want to setup and test
it out, without going through the pains of a software build.
Now that I said that here's......
/*
* Sandia National Laboratories also makes no representations about the
* suitability of the modifications, or additions to this software for
* any purpose. It is provided "as is" without express or implied warranty.
*/
So let us know who is doing what with version 5..................
gmachin@sandia.gov
