[33545] in Kerberos
Re: RFC: Turning off reverse hostname resolution by default in 1.10
daemon@ATHENA.MIT.EDU (Nico Williams)
Wed Jul 6 14:11:08 2011
MIME-Version: 1.0
In-Reply-To: <201107061727.p66HROpE002297@outgoing.mit.edu>
Date: Wed, 6 Jul 2011 13:10:59 -0500
Message-ID: <CAK3OfOiH09vBdXa_S7pkBc3Hp2UmmndUX=2KcOax_xHF4CdtwQ@mail.gmail.com>
From: Nico Williams <nico@cryptonector.com>
To: ghudson@mit.edu
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
I would also recommend finding a way to get rid of the forward
resolution as well. That's more difficult because
krb5_sname_to_principal() lacks context that might be helpful to
hostbased principal canonicalization. One approach might be to add a
new form(s) of that function that accepts additional contextual
arguments then start using it instead of the old function.
In any case, +1 from me.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
