disable hostname canonicalization by Kerberos library #381
Conversation
By default, Kerberos client library attempts to canonicalize service hostname in TGS requests. This can fail e.g. if hosts file on the client machine references short names before FQDNs. In this case the short name is used in TGS_REQ which KDC fails to resolve. Since we do not (yet) support referencing hosts by their short names it is safe to just disable this behavior in krb5.conf and use supplied FQDNs. https://fedorahosted.org/freeipa/ticket/6584
|
One Travis job was failing, I restarted it. |
|
Works as expected. |
|
Thanks for ACK. I would like to ask @simo5 if this change is okay from krb5 point of view and does not pose any security problem for clients. |
|
@martbab this change actually improves security by avoiding a DNS lookup that could be manipulated by an attacker, however it also means some setups may break, because they depend on canonicalization to actually get the correct name, and should be documented in release notes. |
|
To not forget to update the release notes later at release, @martbab could you update the respected fields in both ticket and BZ when the patch is pushed. |
|
@pvoborni will do. |
|
Fixed upstream |
By default, Kerberos client library attempts to canonicalize service
hostname in TGS requests. This can fail e.g. if hosts file on the client
machine references short names before FQDNs. In this case the short name
is used in TGS_REQ which KDC fails to resolve.
Since we do not (yet) support referencing hosts by their short names it
is safe to just disable this behavior in krb5.conf and use supplied
FQDNs.
https://fedorahosted.org/freeipa/ticket/6584