[8024] in Kerberos
Re: workaround for default max_life of 0
daemon@ATHENA.MIT.EDU (Christoph Hoegl)
Wed Sep 18 13:55:16 1996
To: "Barry Jaspan" <bjaspan@MIT.EDU>
In-Reply-To: bjaspan's message of Wed, 18 Sep 1996 11:00:05 -0400.
<9609181500.AA11946@DUN-DUN-NOODLES.MIT.EDU>
Cc: kerberos@MIT.EDU
Date: Wed, 18 Sep 1996 19:31:53 +0200
From: Christoph Hoegl <darkwing@bsdd.regensburg.com>
> =
> Well, this is another one of those "oops" situations. :-)
> =
> If you do not set the max_life relation in kdc.conf, the KADM5 library
> provides a default value of 0. Clearly KADM5 expects the KDC to
> interpret a zero max_life as "unlimited," but the KDC is actually
unlimited life is - in my eyes - a very bad idea for security
If it were there wouldn=B4t be any tools to generate a new password;-)
> interpreting it as zero, and thus generating tickets with no lifetime.
> After thinking about it, I believe the KDC is right and KADM5 is
> wrong.
> =
> The workaround to the problem is to add a max_life field to kdc.conf,
> like this:
> =
> [realms]
> DEMO.COM =3D {
> <other stuff>
> max_life =3D 10h 0m 0s
> <other stuff>
> }
> =
> The correct fix is for KADM5 to assume a reasonable default if
> max_life is not specified, such as 8 hours. This will be fixed in the
> next release.
Perhaps there should be another variable implemented for this or even bet=
ter
a redirection of use for the max_life
max_renewable_life should be - at least in my eyes - the maximum time a c=
ontext
should be allowed to live with all refreshes.
max_life should be - ** - the default "maximum lifetime" for a ticket unt=
il it
dies and has to be refreshed
max_life !=3D maximum time which is given a ticket by default (it=B4s lif=
e can be =
shortened by kdestroy, therefore maximum)
> =
> Barry
> =
> PS: No one really expected a completely new admin system to be dropped
> into Kerberos with a number of this kind of small, annoying problems
> being found, did they? :-)
b7 is quite a good job:-) if there weren=B4t any problems we wouldn=B4t h=
ave any =
work and would be bored die:-)
Christoph
-- =
Christoph Hoegl / darkwing@bsdd.regensburg.com / (Darkwing@berkeley.edu)
Siedlungsstr. 18 93128 Regenstauf Germany Fax:+49 940270611
Tellerrd. 12a 93720 Berkeley CA USA Fax:+1 (510) 642 1043
