[2672] in Kerberos-V5-bugs
krb5-clients/380: krb524init chooses (interfaces) poorly
daemon@ATHENA.MIT.EDU (matt@MIT.EDU)
Wed Feb 19 20:57:53 1997
Resent-From: gnats@rt-11.MIT.EDU (GNATS Management)
Resent-To: krb5-unassigned@RT-11.MIT.EDU
Resent-Reply-To: krb5-bugs@MIT.EDU, matt@MIT.EDU
Date: Wed, 19 Feb 1997 20:54:21 -0500
From: matt@MIT.EDU
Reply-To: matt@MIT.EDU
To: krb5-bugs@MIT.EDU
Cc: matt@MIT.EDU
>Number: 380
>Category: krb5-clients
>Synopsis: krb524init choses the wrong interface on multihomed machines
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: krb5-unassigned
>State: open
>Class: sw-bug
>Submitter-Id: unknown
>Arrival-Date: Wed Feb 19 20:55:01 EST 1997
>Last-Modified:
>Originator: Matt Braun
>Organization:
>Release: 1.0
>Environment:
System: SunOS gag 4.1.3 U1 sun4c sparc
A multihomed machine with a ppp interface and an ethernet interface
>Description:
I kinit and get krb5 tickets (for both IP addresses) and then run krb524init
to get krb4 tickets I can use with zephyr. Since krb4 only allows one
address, the krb524initd chooses the first one. In my case it chose poorly and
the ticket was useless.
>How-To-Repeat:
kinit (krb5) on a multihomes machine then run krb524init. Try doing things
with those tickets from both interfaces, one should fail.
>Fix:
There are 3 solutions I see. 1) add an option to kinit to specify the
addresses that the tickets are usable on. 2) have krb524initd 'guess' which
address to use based on where the packet came from and 3) add an argument to
krb524init to specify which address to use...although this might require a
protocol change.
>Audit-Trail:
>Unformatted:
Matt Braun
