[33553] in Kerberos
Re: RFC: Turning off reverse hostname resolution by default in 1.10
daemon@ATHENA.MIT.EDU (Jeffrey Altman)
Wed Jul 6 16:02:14 2011
X-Envelope-From: jaltman@secure-endpoints.com
X-MDaemon-Deliver-To: kerberos@mit.edu
Message-ID: <4E14BF3A.4090501@secure-endpoints.com>
Date: Wed, 06 Jul 2011 16:02:02 -0400
From: Jeffrey Altman <jaltman@secure-endpoints.com>
MIME-Version: 1.0
To: simo@redhat.com
In-Reply-To: <1309976570.8182.2.camel@willson.li.ssimo.org>
Cc: Ken Hornstein <kenh@cmf.nrl.navy.mil>, kerberos@mit.edu
Reply-To: jaltman@secure-endpoints.com
Content-Type: multipart/mixed; boundary="===============0518590310=="
Errors-To: kerberos-bounces@mit.edu
This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--===============0518590310==
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature";
boundary="------------enigC5708DCB85683A45CABD1371"
This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enigC5708DCB85683A45CABD1371
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
On 7/6/2011 2:22 PM, Simo Sorce wrote:
> I would resolve all these issues by using aliases at the KDC level, but=
> thank you for explaining, it's valuable data on the way KDC/DNS are use=
d
> to keep track off.
The primary thing that the Kerberos development team needs to keep in
mind every time a change is made is that Kerberos deployments are
distributed and federated. In many of the environments there are many
realms involved which are managed by different organizations. Upgrading
clients and KDCs cannot be performed in lock step and there is no
ability to coordinate which comes first the KDC / KDB update or the
client deployments.
Any transition plan to alter canonical name resolution processing must
take that into account. It must be possible for a client machine to be
updated in one organization or on one individual's machine and have it
continue to work when the KDC/KDB for the realm that client communicates
with is not updated to support KDC side aliasing.
Just my two cents ...
Jeffrey Altman
--------------enigC5708DCB85683A45CABD1371
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
iQEcBAEBAgAGBQJOFL88AAoJENxm1CNJffh49K0IALz4TdkKLip7k8jFHa5iwD3l
U757+Shh+ve5hY6s6rV6rVIQ9eABz5n1+aksoH4liNfBBY1JbR3AUr9DoaywPwhS
ssYKi/2I+meYs9ue5aCiPeGEFUNZOID5cv21X5FUeO/BRtYT+xRZhMDE4rHKSxQt
9oH2d1VGIKjpRtbeLKGNEf6lGxWlLYMSzwFpXULM1j7wJuUUiDWDObvdjfYM5AxC
EIXiNlCzJ/l94V1X6EXQubmaiZtIxSTaZJRxzdAwhDisg0dqEfrvI67doSY0nLzH
uT7t2u3aKgsRplA23ulWe7hBfBjTacEG4NlTqDgFUn3UjCHnRpEQ8MKdR01Q6tM=
=unaB
-----END PGP SIGNATURE-----
--------------enigC5708DCB85683A45CABD1371--
--===============0518590310==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
--===============0518590310==--
