[33547] in Kerberos
Re: RFC: Turning off reverse hostname resolution by default in 1.10
daemon@ATHENA.MIT.EDU (Nico Williams)
Wed Jul 6 14:25:06 2011
MIME-Version: 1.0
In-Reply-To: <201107061801.p66I1B6K013765@hedwig.cmf.nrl.navy.mil>
Date: Wed, 6 Jul 2011 13:24:59 -0500
Message-ID: <CAK3OfOicWCoRrjz8xZuQ6Hwn==KM=9_k+W1rxF_qgFNtFSgnUQ@mail.gmail.com>
From: Nico Williams <nico@cryptonector.com>
To: Ken Hornstein <kenh@cmf.nrl.navy.mil>
Cc: Simo Sorce <simo@redhat.com>, kerberos@mit.edu
Content-Type: text/plain; charset="utf-8"
Errors-To: kerberos-bounces@mit.edu
Content-Transfer-Encoding: 8bit
On Wed, Jul 6, 2011 at 1:01 PM, Ken Hornstein <kenh@cmf.nrl.navy.mil> wrote:> The answers:>> - Multihomed hosts (we want to connect to a particular interface, but> we want to use one canonical name, because adding a new keytab for a> new interface is more of a pain than simply changing the reverse DNS).> This also comes into issue when you're doing cross-domain multihoming> where the host is in another domain (and other Kerberos realm), and> yes, we do that too (but thankfully not that often).
This can be handled by principal name aliasing on the KDC (whichHeimdal supports). You still need the additional keytab entries (butnot additional actual principals) OR Heimdal'stry-all-keys-with-same-enctype/kvno/realm approach when a key cannotbe found by matching on principal name.
> - Hostname masquerading, where the host has a CNAME pointing to the> "real" name, but for various reasons we want the name used by Kerberos> to be the CNAME.
Same answer, I think.
Nico--
________________________________________________Kerberos mailing list Kerberos@mit.eduhttps://mailman.mit.edu/mailman/listinfo/kerberos
