> -----Original Message-----
> From: Andrew Cobaugh [mailto:[email protected]]
> Sent: Thursday, August 13, 2009 8:36 PM
> To: Xu, Qiang (FXSGSC)
> Cc: Alexey Melnikov; [email protected]
> Subject: Re: IPv6 handling in SASL LDAP binding
>
> On Thu, Aug 13, 2009 at 6:41 AM, Xu, Qiang
> (FXSGSC)<[email protected]> wrote:
> >
> > P.S. Can I ask why the numerical IPv6 address is not
> supported in MIT distribution?
>
> Using IP addresses in files like krb5.conf is generally
> discouraged, as it's easier to change a single entry in dns
> than it is to change a file on every machine. We don't even
> specify the kdcs in krb5.conf in our environment, relying
> entirely on srv records for kdc discovery.
>
> I suppose this could be considered a bug, if anyone cared.
In my testing, I found both hostname and IPv4 address works for kinit (in
original MIT distribution), but not IPv6 address:
=========================================================
/* The content of /etc/krb5.conf with hostname */
[realms]
XCIPV6.COM = {
kdc = crius:88
default_domain = xcipv6.com
}
/* Kerberos authentication result */
q...@durian(pts/3):/etc[117]$ kinit [email protected]
Password for [email protected]:
q...@durian(pts/3):/etc[118]$ klist
Ticket cache: FILE:/tmp/krb5cc_20153
Default principal: [email protected]
Valid starting Expires Service principal
08/14/09 09:02:48 08/14/09 19:03:53 krbtgt/[email protected]
renew until 08/15/09 09:02:48
/* The content of /etc/krb5.conf with IPv4 */
[realms]
XCIPV6.COM = {
kdc = 13.198.97.42:88
default_domain = xcipv6.com
}
/* Kerberos authentication result */
q...@durian(pts/3):/etc[122]$ klist
Ticket cache: FILE:/tmp/krb5cc_20153
Default principal: [email protected]
Valid starting Expires Service principal
08/14/09 09:05:14 08/14/09 19:05:39 krbtgt/[email protected]
renew until 08/15/09 09:05:14
/* The content of /etc/krb5.conf with IPv6 address */
[realms]
XCIPV6.COM = {
kdc = [3ffe:2000:0:1::100]:88
default_domain = xcipv6.com
}
/* Kerberos authentication result */
q...@durian(pts/3):/etc[112]$ kinit [email protected]
kinit(v5): Cannot resolve network address for KDC in realm XCIPV6.COM while
getting initial credentials
=========================================================
Personally, I think if numerical IPv4 address is supported for kdc entry in
/etc/krb5.conf, so should be for numerical IPv6 address.
Would MIT developers want to fix this as a bug? The related source code is the
function "krb5_locate_srv_conf_1()" in the file
"krb5-1.7/src/lib/krb5/os/locate_kdc.c".
Thanks,
Xu Qiang
________________________________________________
Kerberos mailing list [email protected]
https://mailman.mit.edu/mailman/listinfo/kerberos
