diff options
| author | Sam Hartman <hartmans@mit.edu> | 2003-03-17 01:03:11 +0000 |
|---|---|---|
| committer | Sam Hartman <hartmans@mit.edu> | 2003-03-17 01:03:11 +0000 |
| commit | eeefea9966e50bf16af6e2df9e8b74d892598bef (patch) | |
| tree | a90a9b3603e6fec48c0b7febcb26e0c83e01752f /src/kdc/ChangeLog | |
| parent | 1b190c9ac0a47f4dbd8db4a2e191758fc8d030f7 (diff) | |
| download | krb5-eeefea9966e50bf16af6e2df9e8b74d892598bef.tar.gz krb5-eeefea9966e50bf16af6e2df9e8b74d892598bef.tar.xz krb5-eeefea9966e50bf16af6e2df9e8b74d892598bef.zip | |
Disable krb4 cross-realm in krb524d and krb5kdc. Provide an option to
reenable (-X) which prints a warning that you are creating a security
hole.
Remove support for generating krb4 tickets encrypted using 3DES
service keys as it is insecure. They are still accepted however.
The KDc is much more strict about accepting only tickets that it would
have issued in the current configuration. In particular if the KDC
would choose some enctype for writing a TGT, other enctypes will not
be accepted when using a TGT.
Ticket: 1385
Target_Version: 1.3
Tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15286 dc483132-0cff-0310-8789-dd5450dbe970
Diffstat (limited to 'src/kdc/ChangeLog')
| -rw-r--r-- | src/kdc/ChangeLog | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/src/kdc/ChangeLog b/src/kdc/ChangeLog index eb4273615..040281988 100644 --- a/src/kdc/ChangeLog +++ b/src/kdc/ChangeLog @@ -1,3 +1,16 @@ +2003-03-16 Sam Hartman <hartmans@mit.edu> + + * main.c (initialize_realms): Add support to call + enable_v4_crossrealm if the user wants insecure operation + + * kerberos_v4.c: Add enable_v4_crossrealm. By default krb4 + cross-realm is not allowed as it is insecure. Also, remove + support for generating krb4 tickets encrypted in 3DES as they are + insecure. + + * kdc_util.h: Define enable_v4_crossrealm, new function to enable + secure krb4 cross-realm authentication + 2003-03-05 Tom Yu <tlyu@mit.edu> * main.c (init_realm): Update call to krb5_ktdb_resolve(). |