[4011] in Kerberos-V5-bugs
[krbdev.mit.edu #1380] Duplicate DNS Lookups make krb5_init_creds
daemon@ATHENA.MIT.EDU (Alexandra Ellwood via RT)
Wed Mar 12 17:26:17 2003
Date: Wed, 12 Mar 2003 17:26:07 -0500 (EST)
Message-Id: <rt-1380-5370.10.7388021023411@krbdev.mit.edu>
In-Reply-To: <rt-1380@krbdev.mit.edu>
From: "Alexandra Ellwood via RT" <rt-comment@krbdev.mit.edu>
To: krb5-prs@MIT.EDU
Reply-To: rt-comment@krbdev.mit.edu
Errors-To: krb5-bugs-bounces@mit.edu
Getting tickets with 1.3 on KfM can be slow because of DNS requests.
Attached is a tcpdump of the DNS request interleaved with the krb5
requests. krb5_sendto_kdc calls krb5_locate_kdc twice for udp and tcp
respectively, so each kdc in the config file is looked up twice. For
some reason on Mac OS X 10.2.4, these queries are not cached by lookupd.
Also, I didn't notice these problems until I started compiling with
KRB5_DNS_LOOKUP and KRB5_DNS_LOOKUP_KDC 1 (previously they were 0 on the
Mac). I couldn't figure out from the code why this was, since my config
file contains:
[libdefaults]
dns_lookup_realm = false
dns_lookup_kdc = false
In the config file, the Athena realm is specified as:
[realms]
ATHENA.MIT.EDU = {
kdc = kerberos.mit.edu.:88
kdc = kerberos-1.mit.edu.:88
kdc = kerberos-2.mit.edu.:88
kdc = kerberos-3.mit.edu.:88
admin_server = kerberos.mit.edu.
default_domain = mit.edu
}
Obviously removing the .s at the end of the kdc names will result in
more lookups and more slowness.
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
http://mailman.mit.edu/mailman/listinfo/krb5-bugs
