[18925] in Kerberos_V5_Development
Re: How often does MIT krb5 request for KDC info through DNS?
daemon@ATHENA.MIT.EDU (Nico Williams)
Mon Aug 4 13:30:09 2014
Date: Mon, 4 Aug 2014 12:29:59 -0500
From: Nico Williams <nico@cryptonector.com>
To: Wang Weijun <weijun.wang@oracle.com>
Message-ID: <20140804172957.GN3579@localhost>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <D873712D-3AD7-489F-AA44-C783163E5499@oracle.com>
Cc: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Mon, Aug 04, 2014 at 01:28:31PM +0800, Wang Weijun wrote:
> KDC info can be retrieved from a DNS server but how often does MIT
> krb5 request for it? I grabbed some packets and it seems there are 6
> rounds of requests within 3 minutes. The DNS server I am querying
> returns answers with TTL of 10 minutes so it looks like not honored.
The Kerberos library isn't a DNS resolver; it uses one.
Therefore the Kerberos library should ask often, possibly even every
time it does a KDC request.
You should configure your system to have a caching resolver on
127.0.0.1.
> I tried to read the source codes but haven't spotted a cache or
> something similar.
Ideally there should be no cache for DNS results in the library.
Some things should be cached, like: the local host's FQDN (it shouldn't
change, right?), default realm (if not set and it had to be determined
from context, e.g., the user's or host's realm), and so on. But not DNS
lookups -- that's the resolver's job. If your resolver is not a caching
resolver, then fix it :)
Nico
--
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
