[
https://issues.apache.org/jira/browse/HADOOP-9868?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13741887#comment-13741887
]
Alejandro Abdelnur commented on HADOOP-9868:
--------------------------------------------
[~kihwal], the scenario I'm thinking does not require a compromised DNS. It is
the following:
real service listening at host1:10000 with principal foo/host1 crashes.
fake service starts listening at host1:10000 with principal bar/host1, and it
advertises its principal is bar/host1.
granted this requires a bar/host1 keytab.
I have not looked at the patch, so I don't know what safeguards it has. Can you
confirm the behavior in the following 2 scenarios?
1. Does the client accept an arbitrary principal without a service host name?
the server advertising 'bar' as principal, no hostname.
I think the client should not accept this alternate.
2. Does the client accept an alternate advertised with the a different
shortname than one used originally by the client? using example above: original
server principal submitted by the client foo/host1, advertised server principal
bar/host1.
I think we should reject that scenario, as it would cover the case when keytabs
for foo/* principals are not compromised. So an alternate o foo/host1a would be
ok but a bar/host1 would not.
> Server must not advertise kerberos realm
> ----------------------------------------
>
> Key: HADOOP-9868
> URL: https://issues.apache.org/jira/browse/HADOOP-9868
> Project: Hadoop Common
> Issue Type: Bug
> Components: ipc
> Affects Versions: 3.0.0, 2.1.1-beta
> Reporter: Daryn Sharp
> Assignee: Daryn Sharp
> Priority: Blocker
> Fix For: 3.0.0, 2.1.1-beta
>
> Attachments: HADOOP-9868.patch
>
>
> HADOOP-9789 broke kerberos authentication by making the RPC server advertise
> the kerberos service principal realm. SASL clients and servers do not
> support specifying a realm, so it must be removed from the advertisement.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
