** Description changed:
- Versions of krb5 prior to 1.21 store the time delta until password
- expiry in a signed 32-bit integer, meaning they cannot represent times
- more than 2^31-1 seconds in the future, or about 68 years. Windows
- Server 2025's Active Directory uses a fake password expiry date in 2100
- for accounts with no password expiry date, which is further in the
- future than that, and therefore this delta wraps around to being
- negative. This then counts as being less than 1 week, so it goes on to
- print a password expiry warning (opting for the "most pressing" one of 1
- hour, since it is also less than 3600 seconds).
+ [ Impact ]
+
+ On Jammy and Noble, krb5 stores the time delta until password as a
+ 32-bit signed integer, meaning that passwords expiring later than ~2100
+ (notably including the fake password expiry dates used by Windows Server
+ 2025 AD) will print an erroneous password expiry warning of the highest
+ urgency of 1 hour (since the overflowed negative delta is in fact sooner
+ than one hour)
+
+ This is fixed by backporting the upstream patch for this issue.
+
+ [ Test Plan ]
+
+ $ apt update
+ $ apt install krb5-user krb5-kdc krb5-admin-server
+ $ cat <<EOF > /etc/krb5.conf
+ [libdefaults]
+ default_realm = TEST.LOCAL
+ [realms]
+ TEST.LOCAL = {
+ kdc = 127.0.0.1
+ admin_server = 127.0.0.1
+ }
+ EOF
+ $ kdb5_util create -s -r TEST.LOCAL -P kdcpassword
+ $ systemctl restart krb5-kdc krb5-admin-server
+ $ kadmin.local -q "addprinc -pw secret -pwexpire 2100-09-14 testuser"
+ $ kinit testuser
+ // log in with password "secret" here
+ // you will see
+ Warning: Your password will expire in less than one hour on Fri Aug 13
00:00:00 2100
+ // this is the buggy behavior
+
+ $ (enable proposed here)
+ $ apt update
+ $ kinit testuser
+ // enter password "secret"
+ // you will see no output
+ // this is the fixed behavior
+
+ [ Where Problems Could Occur ]
+
+ - As with any backport, this might introduce unexpected regressions
+ which might require further SRUs with other upstream patches
+ - This patch changes the time deltas to unsigned integers. The danger of
+ *unsigned* overflow now exists if, say, a caller of ts_interval swaps
+ the order of start and end time and wasn't adjusted with this patch
+
+ [ Original Bug ]
+ Versions of krb5 prior to 1.21 store the time delta until password expiry in
a signed 32-bit integer, meaning they cannot represent times more than 2^31-1
seconds in the future, or about 68 years. Windows Server 2025's Active
Directory uses a fake password expiry date in 2100 for accounts with no
password expiry date, which is further in the future than that, and therefore
this delta wraps around to being negative. This then counts as being less than
1 week, so it goes on to print a password expiry warning (opting for the "most
pressing" one of 1 hour, since it is also less than 3600 seconds).
This has been seen to occur on both Ubuntu 22.04 and Ubuntu 24.04,
although the former is only by a colleague.
The upstream bug fix for this is
https://github.com/krb5/krb5/commit/29600cf1db888d91c42cbd6cf72652afe8c1ee66.
Output appears as follows:
waltham:~ jrtc4% kinit -l 365d
- Password for [email protected]:
+ Password for [email protected]:
Warning: Your password will expire in less than one hour on Tue 14 Sep 2100
03:48:05 BST
** Merge proposal linked:
https://code.launchpad.net/~graysonwolf/ubuntu/+source/krb5/+git/krb5/+merge/509448
** Merge proposal linked:
https://code.launchpad.net/~graysonwolf/ubuntu/+source/krb5/+git/krb5/+merge/509449
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162744
Title:
kinit: Warns about password expiry for Windows Server 2025 DC
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/krb5/+bug/2162744/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
