[30166] in Kerberos
krb5_sname_to_principal question
daemon@ATHENA.MIT.EDU (Jos Backus)
Tue Jul 29 12:30:40 2008
Date: Tue, 29 Jul 2008 09:29:40 -0700
From: Jos Backus <jos@catnook.com>
To: kerberos@mit.edu
Message-ID: <20080729162940.GA97188@lizzy.catnook.local>
MIME-Version: 1.0
Content-Disposition: inline
Reply-To: jos@catnook.com
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
In Kerberos 1.5, krb5_sname_to_principal calls krb5_get_host_realm which (when
KRB5_DNS_LOOKUP is defined) causes DNS to be queried for a _kerberos.FQDN TXT
RR when no applicable domain_realm entry is found and dns_lookup_realm is set.
In 1.6 the KRB5_DNS_LOOKUP ifdef'ed code was removed. This means that the
domain_realm section HAS to have a matching entry for the machine, mapping it
into a realm, whereas in 1.5 this didn't need to be the case if the above
conditions were met.
I'm aware (from a previous discussion) that the DNS lookups are insecure
(although they _are_ used in the case of failing referrals, in which case
krb5_get_fallback_host_realm is called). But I'm still wondering what the
suggested fix is, beyond the obvious addition to domain_realm.
Comments?
--
Jos Backus
jos at catnook.com
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
