Skip to content


Subversion checkout URL

You can clone with
Download ZIP
historical git-svn mirror of MIT krb5 anonsvn repository
C C++ Python Objective-C Perl Shell Other
Branch: tags/krb5-1-10…
Pull request Compare This branch is 10 commits ahead, 358 commits behind master.

Fetching latest commit…

Cannot retrieve the latest commit at this time

Failed to load latest commit information.


                   Kerberos Version 5, Release 1.10

                            Release Notes
                        The MIT Kerberos Team

Copyright and Other Notices

Copyright (C) 1985-2011 by the Massachusetts Institute of Technology
and its contributors.  All rights reserved.

Please see the file named NOTICE for additional notices.

MIT Kerberos is a project of the MIT Kerberos Consortium.  For more
information about the Kerberos Consortium, see

For more information about the MIT Kerberos software, see

People interested in participating in the MIT Kerberos development
effort should visit

Building and Installing Kerberos 5

The first file you should look at is doc/; it contains
the notes for building and installing Kerberos 5.  The info file has the same information in info file format.  You
can view this using the GNU emacs info-mode, or by using the
standalone info file viewer from the Free Software Foundation.  This
is also available as an HTML file, install.html.

Other good files to look at are and,
which contain the system administrator's guide, and the user's guide,
respectively.  They are also available as info files and, respectively.  These files are
also available as HTML files.

If you are attempting to build under Windows, please see the
src/windows/README file.

Reporting Bugs

Please report any problems/bugs/comments using the krb5-send-pr
program.  The krb5-send-pr program will be installed in the sbin
directory once you have successfully compiled and installed Kerberos
V5 (or if you have installed one of our binary distributions).

If you are not able to use krb5-send-pr because you haven't been able
compile and install Kerberos V5 on any platform, you may send mail to

Please keep in mind that unencrypted e-mail is not secure. If you need
to report a security vulnerability, or send sensitive information,
please PGP-encrypt it to

You may view bug reports by visiting

and logging in as "guest" with password "guest".

DES transition

The Data Encryption Standard (DES) is widely recognized as weak.  The
krb5-1.7 release contains measures to encourage sites to migrate away
from using single-DES cryptosystems.  Among these is a configuration
variable that enables "weak" enctypes, which defaults to "false"
beginning with krb5-1.8.

Major changes in 1.10

Additional background information on these changes may be found at


Code quality:

* Fix MITKRB5-SA-2011-006 KDC denial of service vulnerabilities
  [CVE-2011-1527 CVE-2011-1528 CVE-2011-1529].

* Update the Fortuna implementation to more accurately implement the
  description in _Cryptography Engineering_, and make it the default

* Add an alternative PRNG that relies on the OS native PRNG.

Developer experience:

* Add the ability for GSSAPI servers to use any keytab key for a
  specified service, if the server specifies a host-based name with no
  hostname component.

* In the build system, identify the source files needed for
  per-message processing within a kernel and ensure that they remain

* Allow rd_safe and rd_priv to ignore the remote address.

* Rework KDC and kadmind networking code to use an event loop

Administrator experience:

* Add more complete support for renaming principals.

* Add the profile variable ignore_acceptor_hostname in libdefaults. If
  set, GSSAPI will ignore the hostname component of acceptor names
  supplied by the server, allowing any keytab key matching the service
  to be used.

* Add support for string attributes on principal entries.

* Allow password changes to work over NATs.

End-user experience:

* Add the DIR credential cache type, which can hold a collection of
  credential caches.

* Enhance kinit, klist, and kdestroy to support credential cache
  collections if the cache type supports it.

* Add the kswitch command, which changes the selected default cache
  within a collection.

* Add heuristic support for choosing client credentials based on the
  service realm.

* Add support for $HOME/.k5identity, which allows credential choice
  based on configured rules.

* Add support for localization. (No translations are provided in this
  release, but the infrastructure is present for redistributors to
  supply them.)

krb5-1.10 changes by ticket ID

6118    rename principals
6323    kadmin: rename support
6617    uninitialized values used in mkey-migration code
6732    checks for openpty() aren't made using -lutil
6770    kg_unseal leads to overlap of source and desitination in memcpy...
6813    memory leak in gss_accept_sec_context
6814    Improve kdb5_util load locking and recovery
6816    potential memory leak in spnego
6817    potential null dereference in gss mechglue
6835    accept_sec_context RFC4121 support bug in 1.8.3
6851    pkinit can't parse some valid cms messages
6854    kadmin's ktremove can remove wrong entries when removing kvno 0
6855    Improve acceptor name flexibility
6857    missing ifdefs around IPv6 code
6858    Assume ELF on FreeBSD if objformat doesn't exist
6863    memory leak on SPNEGO error path
6868    Defer hostname lookups in krb5_sendto_kdc
6872    Fix memory leak in t_expire_warn
6874    Fortuna as default PRNG
6878    Add test script for user2user programs
6887    Use first principal in keytab when verifying creds
6889    ftpd parses ftpusers entries that use "restrict" incorrectly
6890    Implement draft-josefsson-gss-capsulate
6891    Add gss_userok and gss_pname_to_uid
6892    Prevent bleed-through of mechglue symbols into loaded mechs
6893    error codes from error responses can be discarded when there's e-data
6894    More sensical mech selection for gss_acquire_cred/accept_sec_context
6895    gss_duplicate_name SPI for SPNEGO
6896    Allow anonymous name to be imported with empty name buffer
6897    Default principal name in the acceptor cred corresponds to
        first entry in associated keytab.
6898    Set correct minor_status value in call to gss_display_status.
6902    S4U impersonated credential KRB5_CC_NOT_FOUND
6904    Install k5login(5) as well as .k5login(5)
6905    support poll() in sendto_kdc.c
6909    Kernel subset
6910    Account lockout policy parameters not documented
6911    Account lockout policy options time format
6914    krb5-1.9.1 static compile error +preliminary patch (fwd)
6915    klist -s trips over referral entries
6918    Localize user interface strings using gettext
6921    Convert preauth_plugin.h to new plugin framework
6922    Work around glibc getaddrinfo PTR lookups
6923    Use AI_ADDRCONFIG for more efficient getaddrinfo
6924    Fix multiple libkdb_ldap memory leaks
6927    chpass_util.c improvements
6928    use timegm() for krb5int_gmt_mktime() when available
6929    Pluggable configuration
6931    Add libedit/readline support to ss.
6933    blocking recv caused our server to hang
6934    don't require a default realm
6944    gss_acquire_cred erroneous failure and potential segfault for caller
6945    spnego_gss_acquire_cred_impersonate_name incorrect usage of
6951    assertion failure when connections fail in service_fds()
6953    Add the DIR ccache type
6954    Add new cache collection APIs
6955    Remove unneeded cccol behaviors
6956    Add ccache collection support to tools
6957    Add krb5_cc_select() API and pluggable interface
6958    Make gss-krb5 use cache collection
6961    Support pkinit: SignedData with no signers (KDC)
6962    pkinit: client: Use SignedData for anonymous
6964    Support special salt type in default krb5_dbe_cpw.
6965    Remove CFLAGS and external deps from krb5-config --libs
6966    Eliminate domain-based client realm walk
6968    [PATCH] Man page fixes
6969    Create e_data as pa_data in KDC interfaces.
6971    Use type-safe callbacks in preauth interface
6974    Make krb5_pac_sign public
6975    Add PKINIT NSS support
6976    Hide gak_fct interface and arguments in clpreauth
6977    Install krb5/preauth_plugin.h
6978    Allow rd_priv/rd_safe without remote address
6979    Allow password changes over NATs
6980    Ensure termination in Windows vsnprintf wrapper
6981    SA-2011-006 KDC denial of service [CVE-2011-1527 CVE-2011-1528 CVE-2011-1529]
6987    Fix krb5_cc_set_config
6988    Fix handling of null edata method in KDC preauth
6989    fix tar invocation in mkrel


Past and present Sponsors of the MIT Kerberos Consortium:

    Carnegie Mellon University
    Centrify Corporation
    Columbia University
    Cornell University
    The Department of Defense of the United States of America (DoD)
    Fidelity Investments
    Iowa State University
    Michigan State University
    The National Aeronautics and Space Administration
        of the United States of America (NASA)
    Network Appliance (NetApp)
    Nippon Telephone and Telegraph (NTT)
    Pennsylvania State University
    Red Hat
    Stanford University
    TeamF1, Inc.
    The University of Alaska
    The University of Michigan
    The University of Pennsylvania

Past and present members of the Kerberos Team at MIT:

    Danilo Almeida
    Jeffrey Altman
    Justin Anderson
    Richard Basch
    Mitch Berger
    Jay Berkenbilt
    Andrew Boardman
    Bill Bryant
    Steve Buckley
    Joe Calzaretta
    John Carr
    Mark Colan
    Don Davis
    Alexandra Ellwood
    Carlos Garay
    Dan Geer
    Nancy Gilman
    Matt Hancher
    Thomas Hardjono
    Sam Hartman
    Paul Hill
    Marc Horowitz
    Eva Jacobus
    Miroslav Jurisic
    Barry Jaspan
    Geoffrey King
    Kevin Koch
    John Kohl
    HaoQi Li
    Jonathan Lin
    Peter Litwack
    Scott McGuire
    Steve Miller
    Kevin Mitchell
    Cliff Neuman
    Paul Park
    Ezra Peisach
    Chris Provenzano
    Ken Raeburn
    Jon Rochlis
    Jeff Schiller
    Jen Selby
    Robert Silk
    Bill Sommerfeld
    Jennifer Steiner
    Ralph Swick
    Brad Thompson
    Harry Tsai
    Zhanna Tsitkova
    Ted Ts'o
    Marshall Vale
    Tom Yu

The following external contributors have provided code, patches, bug
reports, suggestions, and valuable resources:

    Brandon Allbery
    Russell Allbery
    Brian Almeida
    Michael B Allen
    Derek Atkins
    David Bantz
    Alex Baule
    Arlene Berry
    Jeff Blaine
    Radoslav Bodo
    Emmanuel Bouillon
    Michael Calmer
    Ravi Channavajhala
    Srinivas Cheruku
    Leonardo Chiquitto
    Howard Chu
    Andrea Cirulli
    Christopher D. Clausen
    Kevin Coffman
    Simon Cooper
    Sylvain Cortes
    Nalin Dahyabhai
    Roland Dowdeswell
    Jason Edgecombe
    Mark Eichin
    Shawn M. Emery
    Douglas E. Engert
    Peter Eriksson
    Ronni Feldt
    Bill Fellows
    JC Ferguson
    William Fiveash
    Ákos Frohner
    Marcus Granado
    Scott Grizzard
    Helmut Grohne
    Steve Grubb
    Philip Guenther
    Dominic Hargreaves
    Jakob Haufe
    Jeff Hodges
    Love Hörnquist Åstrand
    Ken Hornstein
    Henry B. Hotz
    Luke Howard
    Jakub Hrozek
    Shumon Huque
    Jeffrey Hutzelman
    Wyllys Ingersoll
    Holger Isenberg
    Pavel Jindra
    Joel Johnson
    Mikkel Kruse
    Volker Lendecke
    Jan iankko Lieskovsky
    Ryan Lynch
    Franklyn Mendez
    Markus Moeller
    Paul Moore
    Zbysek Mraz
    Edward Murrell
    Nathaniel McCallum
    Nikos Nikoleris
    Dmitri Pal
    Javier Palacios
    Ezra Peisach
    W. Michael Petullo
    Mark Phalan
    Robert Relyea
    Martin Rex
    Jason Rogers
    Mike Roszkowski
    Guillaume Rousse
    Tom Shaw
    Peter Shoults
    Simo Sorce
    Michael Ströder
    Bjørn Tore Sund
    Rathor Vipin
    Jorgen Wahlsten
    Max (Weijun) Wang
    John Washington
    Marcus Watts
    Simon Wilkinson
    Nicolas Williams
    Ross Wilper
    Xu Qiang
    Hanz van Zijst

The above is not an exhaustive list; many others have contributed in
various ways to the MIT Kerberos development effort over the years.
Other acknowledgments (for bug reports and patches) are in the
doc/CHANGES file.
Something went wrong with that request. Please try again.