I recently needed to bump the kvno of a keytab at a site with a MIT kerberos deployment (i.e. ATHENA.MIT.EDU). The pain of running MIT krb5 on a system with heimdal in base aside, once I set up a jail built with WITHOUT_KERBEROS=yes and installed krb5, I was *still* unable to use k5srvutil (well, kadmin) to update the key (or, in fact, do anything with kadmin): # KRB5_TRACE=/dev/stdout kadmin -p zonetest Authenticating as principal zonetest with password. Password for zonetest@ATHENA.MIT.EDU: [inputs password] kadmin: GSS-API (or Kerberos) error while initializing kadmin interface On the MIT Zephyr IM system, Kerberos developer Greg Hudson suggested that I needed a patch which is due to come out in 1.9.2, https://github.com/krb5/krb5-anonsvn/commit/043533c2f13d2bc69316fdf5ef80f0db581df40f Getting an actual patch file from the github interface seems difficult, but I applied the patch ~by-hand to produce the attached. Please consider including the patch in our port pending the 1.9.2 release. Fix: Patch attached with submission follows: How-To-Repeat: Try to use kadmin.
Responsible Changed From-To: freebsd-ports-bugs->cy Over to maintainer (via the GNATS Auto Assign Tool)
cy 2011-09-06 15:55:36 UTC FreeBSD ports repository Modified files: security/krb5 Makefile Added files: security/krb5/files patch-lib-rpc-clnt_tcp.c Log: Apply patch from MIT KRB5 GIT tree commit: 043533c2f13d2bc69316. libgssrpc was ignorant of the remote address of the kadmin socket, even when it's IPv4. This made old-style GSSAPI authentication fail because it uses the wrong channel bindings. Fix this problem by making clnttcp_create() get the remote address from the socket using getpeername() if the caller doesn't provide it and it's an IPv4 address. PR: 160500 Submitted by: Ben Kaduk <kaduk@mit.edu> Revision Changes Path 1.152 +1 -0 ports/security/krb5/Makefile 1.1 +21 -0 ports/security/krb5/files/patch-lib-rpc-clnt_tcp.c (new) _______________________________________________ cvs-all@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/cvs-all To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
State Changed From-To: open->closed Committed. Thaks for the patch.