Projects/Trust KDC-local name resolution - Revision history

TomYu at 17:35, 12 August 2014

2014-08-12T17:35:22Z

TomYu at 19:13, 11 October 2013

2013-10-11T19:13:18Z

TomYu at 22:27, 24 October 2012

2012-10-24T22:27:19Z

TomYu: move to 1.11 target

2011-10-20T20:33:07Z

move to 1.11 target

TomYu: New page: {{project-early}} {{project-target|1.10}} This project will alter the KDC so that local name service on the KDC host is trusted to produce information for service principal aliases and rea...

2011-02-25T23:54:53Z

New page: {{project-early}} {{project-target|1.10}} This project will alter the KDC so that local name service on the KDC host is trusted to produce information for service principal aliases and rea...

New page

{{project-early}}
{{project-target|1.10}}
This project will alter the KDC so that local name service on the KDC host is trusted to produce information for service principal aliases and realm referrals. As a result, administrators will not need to explicitly construct principal aliases for host-based service principal names. The KDC is assumed to have the ability to look up realm-specific hostnames in a trusted resource, such as an <code>/etc/hosts</code> file, a local master nameserver, or a DNSSEC name service.

Users often like to type aliases or unqualified names for hosts they are attempting to access. In the past, when the krb5 client library constructs the principal name for a host-based service, it does a reverse lookup on the IP address of the desired hostname. This is vulnerable to spoofing attacks and can cause problems in deployments where the administrators do not fully control the reverse lookup information for the IP addresses of their hosts. The forward lookup is also vulnerable but less of an operational problem.

Open questions:

* What existing OS capabilities do we use? things like <code>gethostbyname()</code> and <code>getaddrinfo()</code>?
* Do we replicate some of the domain search logic that exists in BIND?
* If not, how do we know whether to trust a forward lookup that uses the domain search list?

← Older revision		Revision as of 17:35, 12 August 2014
Line 1:		Line 1:
	{{project-early}}		{{project-early}}
−	{{project-target\|1.13}}
	This project will alter the KDC so that local name service on the KDC host is trusted to produce information for service principal aliases and realm referrals. As a result, administrators will not need to explicitly construct principal aliases for host-based service principal names. The KDC is assumed to have the ability to look up realm-specific hostnames in a trusted resource, such as an <code>/etc/hosts</code> file, a local master nameserver, or a DNSSEC name service.		This project will alter the KDC so that local name service on the KDC host is trusted to produce information for service principal aliases and realm referrals. As a result, administrators will not need to explicitly construct principal aliases for host-based service principal names. The KDC is assumed to have the ability to look up realm-specific hostnames in a trusted resource, such as an <code>/etc/hosts</code> file, a local master nameserver, or a DNSSEC name service.

@@ Line 1: / Line 1: @@
 {{project-early}}
-{{project-target|1.12}}
+{{project-target|1.13}}
 This project will alter the KDC so that local name service on the KDC host is trusted to produce information for service principal aliases and realm referrals. As a result, administrators will not need to explicitly construct principal aliases for host-based service principal names. The KDC is assumed to have the ability to look up realm-specific hostnames in a trusted resource, such as an <code>/etc/hosts</code> file, a local master nameserver, or a DNSSEC name service.

@@ Line 1: / Line 1: @@
 {{project-early}}
-{{project-target|1.11}}
+{{project-target|1.12}}
 This project will alter the KDC so that local name service on the KDC host is trusted to produce information for service principal aliases and realm referrals. As a result, administrators will not need to explicitly construct principal aliases for host-based service principal names. The KDC is assumed to have the ability to look up realm-specific hostnames in a trusted resource, such as an <code>/etc/hosts</code> file, a local master nameserver, or a DNSSEC name service.