[18945] in Kerberos_V5_Development
Re: How often does MIT krb5 request for KDC info through DNS?
daemon@ATHENA.MIT.EDU (Simo Sorce)
Tue Aug 5 11:53:48 2014
Message-ID: <1407253987.4573.6.camel@willson.usersys.redhat.com>
From: Simo Sorce <simo@redhat.com>
To: Greg Hudson <ghudson@mit.edu>
Date: Tue, 05 Aug 2014 11:53:07 -0400
In-Reply-To: <53E0E7F8.701@mit.edu>
Mime-Version: 1.0
Cc: Nico Williams <nico@cryptonector.com>,
David Woodhouse <dwmw2@infradead.org>, krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Tue, 2014-08-05 at 10:19 -0400, Greg Hudson wrote:
> On 08/05/2014 07:12 AM, David Woodhouse wrote:
> > I've watched firefox lock up for *minutes* at a time without redrawing
> > itself, and I've found that it's stuck in Kerberos code mostly doing the
> > same Legacy IP and IPv6 DNS lookups for the same set of 30-odd domain
> > controllers, over and over and over and over and over again.
> >
> > Yes, I deployed a local caching nameserver to help with that (and
> > samba-winbind-krb5-locator, and now I'm playing with negative caching on
> > KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN...). But I shouldn't have *had* to.
>
> System administrators shouldn't have to, but platforms should. From a
> software engineering perspective, it's much better if the platform
> provides DNS caching than if every application does its own getaddrinfo
> caching. It's also better from a behavior perspective, because
> applications don't have easy access to DNS TTL information, while the
> platform does.
>
> That said, if the popular platforms aren't interested in providing this
> service, at some point applications have to step in and solve the
> problem even if it's not optimal. We might add some amount of DNS
> caching in libkrb5 at some point (with a very low internal TTL), though
> it isn't super high on the priority list.
In Fedora, at least, we are planning on providing a caching resolver by
default soon.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
