[7980] in Kerberos
Re: kpasswd problem
daemon@ATHENA.MIT.EDU (Doug Engert)
Mon Sep 16 16:37:23 1996
Date: Mon, 16 Sep 1996 15:12:01 -0500
From: Doug Engert <DEEngert@anl.gov>
To: Mark Eichin <eichin@cygnus.com>
Cc: kerberos@MIT.EDU
In-Reply-To: <xe1sp8iwdw1.fsf@maneki-neko.cygnus.com>
Mark Eichin writes:
> You might try this patch -- we fixed this back in April but it looks
> like it didn't get back in to the MIT tree. However, Ken's right in
> noting that there's very little reason to list des:afs3, since there
> isn't a mechanism to migrate to a KAserver database (and the mechanism
> for migrating from it is somewhat cumbersome.) You only need to have
> at least one single-des type for krb524init to work, and that's enough
> for aklog to work...
You may still have a problem with this patch as well. The
lib/crypto/des/afsstring2key.c is expecting the salt.data field to
point to a null terminated string. It can't use the salt.length since
that is now a -1. Note that the krb5_copy_data in kdb_cpw.c may not
add a NULL when copying. There may be other places where the missing
null may cause problems.
The real fix would be to not "cheat and do AFS string2key instead"
(Comment from lib/crypto/des/string2key.c) but rather pass another
flag along indicating which string_to_key to use.
I had sent in a similar modification last month to string2key.c which
would recognize a salt.data which started with "AFS:" as indicating
that the salt.data was to be rebuilt with a NULL, and passed to
afsstring2key.c I was doing this to show that I could take a key from
the anl.gov AFS cell, add it the dce.anl.gov DCE security registry
with a "pepper/salt" of "AFS:anl.gov" and have the K5 kinit work. This
would allow for an easy migration from a AFS cell to a DCE cell while
keeping the same password, even if the cell names were different.
--
Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444 <New Area Code 8/3/96>
PGP Key fingerprint = 20 2B 0C 78 43 8A 9C A6 29 F7 A3 6D 5E 30 A6 7F
