[18775] in Kerberos_V5_Development
Re: otp over radius preauthentication
daemon@ATHENA.MIT.EDU (Greg Hudson)
Mon May 19 10:15:22 2014
Message-ID: <537A11EC.40509@mit.edu>
Date: Mon, 19 May 2014 10:15:08 -0400
From: Greg Hudson <ghudson@mit.edu>
MIME-Version: 1.0
To: Frederic Van Espen <frederic.ve@gmail.com>
In-Reply-To: <CAJPacseBrQaH_30ZB1KBvATGhjHbDVeNLp1FWGD1f2_hvAo9yA@mail.gmail.com>
Cc: "krbdev@mit.edu" <krbdev@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
I took this off-list to avoid excessive noise. Here is a summary of our
findings:
* Frederic was using a system verto package at version 0.2.4, which had
a bug in the libev implementation of verto_set_flags. This was causing
the OTP plugin to be unable to see RADIUS replies. Upgrading to verto
0.2.6 fixed the problem. The bundled version of verto in the krb5
sources (0.2.5) is unaffected.
* There is a KDC crash bug when the principal's OTP config contains
invalid JSON. I have submitted a fix, which will be in 1.12.2. (This
isn't a security issue because principal OTP configuration is trusted
input. It's a null pointer dereference only.)
* kadmin does not make it easy to set string attributes containing JSON
values because of quoting issues. It would be good if we could address
this, but I don't have an idea at the moment. For now you have to write
things like:
setstr princname otp "[{""type"": ""yubikey""}]"
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
