[33544] in Kerberos
Re: RFC: Turning off reverse hostname resolution by default in 1.10
daemon@ATHENA.MIT.EDU (Ken Hornstein)
Wed Jul 6 14:01:20 2011
Message-Id: <201107061801.p66I1B6K013765@hedwig.cmf.nrl.navy.mil>
From: Ken Hornstein <kenh@cmf.nrl.navy.mil>
To: Simo Sorce <simo@redhat.com>
In-Reply-To: <1309974570.8182.0.camel@willson.li.ssimo.org>
Date: Wed, 06 Jul 2011 14:01:11 -0400
Cc: kerberos@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
>On Wed, 2011-07-06 at 13:41 -0400, Ken Hornstein wrote:
>> >Does anyone on this list intentionally rely on PTR lookups for
>> >Kerberos hostname canonicalization?
>>
>> "Yes".
>>
>> (I can go into detail if you really care).
>
>I am interested if you can explain.
The answers:
- Multihomed hosts (we want to connect to a particular interface, but
we want to use one canonical name, because adding a new keytab for a
new interface is more of a pain than simply changing the reverse DNS).
This also comes into issue when you're doing cross-domain multihoming
where the host is in another domain (and other Kerberos realm), and
yes, we do that too (but thankfully not that often).
- Hostname masquerading, where the host has a CNAME pointing to the
"real" name, but for various reasons we want the name used by Kerberos
to be the CNAME.
I admit that these issues are not insurmountable. But I am just answering
the question that Greg asked.
--Ken
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
