1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
|
Kerberos Version 5, Release 1.10
Release Notes
The MIT Kerberos Team
Copyright and Other Notices
---------------------------
Copyright (C) 1985-2012 by the Massachusetts Institute of Technology
and its contributors. All rights reserved.
Please see the file named NOTICE for additional notices.
MIT Kerberos is a project of the MIT Kerberos Consortium. For more
information about the Kerberos Consortium, see http://kerberos.org/
For more information about the MIT Kerberos software, see
http://web.mit.edu/kerberos/
People interested in participating in the MIT Kerberos development
effort should visit http://k5wiki.kerberos.org/
Building and Installing Kerberos 5
----------------------------------
The first file you should look at is doc/install-guide.ps; it contains
the notes for building and installing Kerberos 5. The info file
krb5-install.info has the same information in info file format. You
can view this using the GNU emacs info-mode, or by using the
standalone info file viewer from the Free Software Foundation. This
is also available as an HTML file, install.html.
Other good files to look at are admin-guide.ps and user-guide.ps,
which contain the system administrator's guide, and the user's guide,
respectively. They are also available as info files
kerberos-admin.info and krb5-user.info, respectively. These files are
also available as HTML files.
If you are attempting to build under Windows, please see the
src/windows/README file.
Reporting Bugs
--------------
Please report any problems/bugs/comments using the krb5-send-pr
program. The krb5-send-pr program will be installed in the sbin
directory once you have successfully compiled and installed Kerberos
V5 (or if you have installed one of our binary distributions).
If you are not able to use krb5-send-pr because you haven't been able
compile and install Kerberos V5 on any platform, you may send mail to
krb5-bugs@mit.edu.
Please keep in mind that unencrypted e-mail is not secure. If you need
to report a security vulnerability, or send sensitive information,
please PGP-encrypt it to krbcore-security@mit.edu.
You may view bug reports by visiting
http://krbdev.mit.edu/rt/
and logging in as "guest" with password "guest".
DES transition
--------------
The Data Encryption Standard (DES) is widely recognized as weak. The
krb5-1.7 release contains measures to encourage sites to migrate away
from using single-DES cryptosystems. Among these is a configuration
variable that enables "weak" enctypes, which defaults to "false"
beginning with krb5-1.8.
Major changes in 1.10.1
-----------------------
This is a bugfix release.
* Fix access controls for KDB string attributes [CVE-2012-1012]
* Make the ASN.1 encoding of key version numbers interoperate with
Windows Read-Only Domain Controllers
* Avoid generating spurious password expiry warnings in cases where
the KDC sends an account expiry time without a password expiry time.
krb5-1.10.1 changes by ticket ID
--------------------------------
7074 workaround for Solaris 8 lacking isblank
7081 Don't use stack variable address in as_req state
7082 Various lookaside cache fixes
7084 Don't check mech in krb5_gss_inquire_cred_by_mech
7087 krb5_gss_get_name_attribute fails to set display_value
7088 Fix uninitialized variable warning in trval.c
7089 Initialize gss_get_name_attribute output buffers
7092 kvno ASN.1 encoding interop with Windows RODCs
7093 Access controls for string RPCs [CVE-2012-1012]
7096 Fix KDB iteration when callback does write calls
7098 Fix spurious password expiry warning
Major changes in 1.10
---------------------
Additional background information on these changes may be found at
http://k5wiki.kerberos.org/wiki/Release_1.10
and
http://k5wiki.kerberos.org/wiki/Category:Release_1.10_projects
Code quality:
* Fix MITKRB5-SA-2011-006 and MITKRB5-SA-2011-007 KDC denial of
service vulnerabilities [CVE-2011-1527 CVE-2011-1528 CVE-2011-1529
CVE-2011-1530].
* Update the Fortuna implementation to more accurately implement the
description in _Cryptography Engineering_, and make it the default
PRNG.
* Add an alternative PRNG that relies on the OS native PRNG.
Developer experience:
* Add the ability for GSSAPI servers to use any keytab key for a
specified service, if the server specifies a host-based name with no
hostname component.
* In the build system, identify the source files needed for
per-message processing within a kernel and ensure that they remain
independent.
* Allow rd_safe and rd_priv to ignore the remote address.
* Rework KDC and kadmind networking code to use an event loop
architecture.
* Add a plugin interface for providing configuration information.
Administrator experience:
* Add more complete support for renaming principals.
* Add the profile variable ignore_acceptor_hostname in libdefaults. If
set, GSSAPI will ignore the hostname component of acceptor names
supplied by the server, allowing any keytab key matching the service
to be used.
* Add support for string attributes on principal entries.
* Allow password changes to work over NATs.
End-user experience:
* Add the DIR credential cache type, which can hold a collection of
credential caches.
* Enhance kinit, klist, and kdestroy to support credential cache
collections if the cache type supports it.
* Add the kswitch command, which changes the selected default cache
within a collection.
* Add heuristic support for choosing client credentials based on the
service realm.
* Add support for $HOME/.k5identity, which allows credential choice
based on configured rules.
* Add support for localization. (No translations are provided in this
release, but the infrastructure is present for redistributors to
supply them.)
Protocol evolution:
* Make PKINIT work with FAST in the client library.
krb5-1.10 changes by ticket ID
------------------------------
6118 rename principals
6323 kadmin: rename support
6430 Avoid looping when preauth can't be generated
6617 uninitialized values used in mkey-migration code
6732 checks for openpty() aren't made using -lutil
6770 kg_unseal leads to overlap of source and desitination in memcpy...
6813 memory leak in gss_accept_sec_context
6814 Improve kdb5_util load locking and recovery
6816 potential memory leak in spnego
6817 potential null dereference in gss mechglue
6835 accept_sec_context RFC4121 support bug in 1.8.3
6851 pkinit can't parse some valid cms messages
6854 kadmin's ktremove can remove wrong entries when removing kvno 0
6855 Improve acceptor name flexibility
6857 missing ifdefs around IPv6 code
6858 Assume ELF on FreeBSD if objformat doesn't exist
6863 memory leak on SPNEGO error path
6868 Defer hostname lookups in krb5_sendto_kdc
6872 Fix memory leak in t_expire_warn
6874 Fortuna as default PRNG
6878 Add test script for user2user programs
6887 Use first principal in keytab when verifying creds
6890 Implement draft-josefsson-gss-capsulate
6891 Add gss_userok and gss_pname_to_uid
6892 Prevent bleed-through of mechglue symbols into loaded mechs
6893 error codes from error responses can be discarded when there's e-data
6894 More sensical mech selection for gss_acquire_cred/accept_sec_context
6895 gss_duplicate_name SPI for SPNEGO
6896 Allow anonymous name to be imported with empty name buffer
6897 Default principal name in the acceptor cred corresponds to
first entry in associated keytab.
6898 Set correct minor_status value in call to gss_display_status.
6902 S4U impersonated credential KRB5_CC_NOT_FOUND
6904 Install k5login(5) as well as .k5login(5)
6905 support poll() in sendto_kdc.c
6909 Kernel subset
6910 Account lockout policy parameters not documented
6911 Account lockout policy options time format
6914 krb5-1.9.1 static compile error +preliminary patch (fwd)
6915 klist -s trips over referral entries
6918 Localize user interface strings using gettext
6921 Convert preauth_plugin.h to new plugin framework
6922 Work around glibc getaddrinfo PTR lookups
6923 Use AI_ADDRCONFIG for more efficient getaddrinfo
6924 Fix multiple libkdb_ldap memory leaks
6927 chpass_util.c improvements
6928 use timegm() for krb5int_gmt_mktime() when available
6929 Pluggable configuration
6931 Add libedit/readline support to ss.
6933 blocking recv caused our server to hang
6934 don't require a default realm
6936 multiple mechanisms and spnego_gss_init_sec_context
6944 gss_acquire_cred erroneous failure and potential segfault for caller
6945 spnego_gss_acquire_cred_impersonate_name incorrect usage of
impersonator_cred_handle
6951 assertion failure when connections fail in service_fds()
6953 Add the DIR ccache type
6954 Add new cache collection APIs
6955 Remove unneeded cccol behaviors
6956 Add ccache collection support to tools
6957 Add krb5_cc_select() API and pluggable interface
6958 Make gss-krb5 use cache collection
6961 Support pkinit: SignedData with no signers (KDC)
6962 pkinit: client: Use SignedData for anonymous
6964 Support special salt type in default krb5_dbe_cpw.
6965 Remove CFLAGS and external deps from krb5-config --libs
6966 Eliminate domain-based client realm walk
6968 [PATCH] Man page fixes
6969 Create e_data as pa_data in KDC interfaces.
6971 Use type-safe callbacks in preauth interface
6974 Make krb5_pac_sign public
6975 Add PKINIT NSS support
6976 Hide gak_fct interface and arguments in clpreauth
6977 Install krb5/preauth_plugin.h
6978 Allow rd_priv/rd_safe without remote address
6979 Allow password changes over NATs
6980 Ensure termination in Windows vsnprintf wrapper
6981 SA-2011-006 KDC denial of service [CVE-2011-1527 CVE-2011-1528
CVE-2011-1529]
6987 Fix krb5_cc_set_config
6988 Fix handling of null edata method in KDC preauth
6989 fix tar invocation in mkrel
6992 Make krb5_find_authdata public
6994 Fix intermediate key length in hmac-md5 checksum
6995 Initialize typed_e_data in as_req_state
6996 Make krb5_check_clockskew public
6997 don't build po/ if msgfmt is missing
6999 compile warnings, mininum version check for pkinit (NSS code paths)
7000 Exit on error in kadmind kprop child
7002 verto sshould have a pointer to upstream sources and be in NOTICE
7003 Fix month/year units in getdate
7006 Fix format string for TRACE_INIT_CREDS_SERVICE
7014 Fix com_err.h dependencies in gss-kernel-lib
7015 Add plugin interface_names entry for ccselect
7017 Simplify and fix kdcpreauth request_body callback
7018 Update verto to 0.2.2 release
7019 Make verto context available to kdcpreauth modules
7020 reading minor error message doesn't work for the IAKERB mech
7021 Fix failure interval of 0 in LDAP lockout code
7023 Clean up client-side preauth error data handling
7027 FAST PKINIT
7029 Fix --with-system-verto without pkg-config
7030 Ldap dependency for parallel builds
7033 krb5 1.10 KRB5_PADATA_ENC_TIMESTAMP isn't working
7034 mk_cred: memory management
7035 krb5_lcc_store() now ignores config credentials
7036 Fix free ofuninitialized memory in sname_to_princ
7037 Use LsaDeregisterLogonProcess(), not CloseHandle()
7038 Added support for loading of Krb5.ini from Windows APPDATA
7039 Handle TGS referrals to the same realm
7042 SA-2011-007 KDC null pointer deref in TGS handling [CVE-2011-1530]
7049 Fix subkey memory leak in krb5_get_credentials
7050 KfW changes for krb5-1.10
7051 krb5_server_decrypt_ticket_keytab wrongly succeeds
7053 Verify acceptor's mech in SPNEGO initiator
7055 Rename Table of Contents.hhc
7057 Krb5 1.9.x does not build on Solaris 8 - Implicit function
declaration error
7060 Convert securid module edata method
7065 delete duplicate NOTICE file
7067 documentation license to CC-BY-SA 3.0 Unported
7077 LIBS should not include PKINIT_CRYPTO_IMPL_LIBS
7078 Use INSTALL_DATA to install message catalogues
Acknowledgements
----------------
Past and present Sponsors of the MIT Kerberos Consortium:
Apple
Carnegie Mellon University
Centrify Corporation
Columbia University
Cornell University
The Department of Defense of the United States of America (DoD)
Fidelity Investments
Google
Iowa State University
MIT
Michigan State University
Microsoft
The National Aeronautics and Space Administration
of the United States of America (NASA)
Network Appliance (NetApp)
Nippon Telephone and Telegraph (NTT)
Oracle
Pennsylvania State University
Red Hat
Stanford University
TeamF1, Inc.
The University of Alaska
The University of Michigan
The University of Pennsylvania
Past and present members of the Kerberos Team at MIT:
Danilo Almeida
Jeffrey Altman
Justin Anderson
Richard Basch
Mitch Berger
Jay Berkenbilt
Andrew Boardman
Bill Bryant
Steve Buckley
Joe Calzaretta
John Carr
Mark Colan
Don Davis
Alexandra Ellwood
Carlos Garay
Dan Geer
Nancy Gilman
Matt Hancher
Thomas Hardjono
Sam Hartman
Paul Hill
Marc Horowitz
Eva Jacobus
Miroslav Jurisic
Barry Jaspan
Geoffrey King
Kevin Koch
John Kohl
HaoQi Li
Jonathan Lin
Peter Litwack
Scott McGuire
Steve Miller
Kevin Mitchell
Cliff Neuman
Paul Park
Ezra Peisach
Chris Provenzano
Ken Raeburn
Jon Rochlis
Jeff Schiller
Jen Selby
Robert Silk
Bill Sommerfeld
Jennifer Steiner
Ralph Swick
Brad Thompson
Harry Tsai
Zhanna Tsitkova
Ted Ts'o
Marshall Vale
Tom Yu
The following external contributors have provided code, patches, bug
reports, suggestions, and valuable resources:
Ian Abbott
Brandon Allbery
Russell Allbery
Brian Almeida
Michael B Allen
Heinz-Ado Arnolds
Derek Atkins
Mark Bannister
David Bantz
Alex Baule
Adam Bernstein
Arlene Berry
Jeff Blaine
Radoslav Bodo
Emmanuel Bouillon
Michael Calmer
Julien Chaffraix
Ravi Channavajhala
Srinivas Cheruku
Leonardo Chiquitto
Howard Chu
Andrea Cirulli
Christopher D. Clausen
Kevin Coffman
Simon Cooper
Sylvain Cortes
Nalin Dahyabhai
Mark Davies
Dennis Davis
Mark Deneen
Roland Dowdeswell
Jason Edgecombe
Mark Eichin
Shawn M. Emery
Douglas E. Engert
Peter Eriksson
Juha Erkkilä
Ronni Feldt
Bill Fellows
JC Ferguson
William Fiveash
Ákos Frohner
Sebastian Galiano
Marcus Granado
Scott Grizzard
Helmut Grohne
Steve Grubb
Philip Guenther
Dominic Hargreaves
Jakob Haufe
Paul B. Henson
Jeff Hodges
Christopher Hogan
Love Hörnquist Åstrand
Ken Hornstein
Henry B. Hotz
Luke Howard
Jakub Hrozek
Shumon Huque
Jeffrey Hutzelman
Wyllys Ingersoll
Holger Isenberg
Pavel Jindra
Joel Johnson
W. Trevor King
Mikkel Kruse
Volker Lendecke
Jan iankko Lieskovsky
Kevin Longfellow
Ryan Lynch
Nathaniel McCallum
Greg McClement
Cameron Meadors
Alexey Melnikov
Franklyn Mendez
Markus Moeller
Kyle Moffett
Paul Moore
Keiichi Mori
Michael Morony
Zbysek Mraz
Edward Murrell
Nikos Nikoleris
Felipe Ortega
Andrej Ota
Dmitri Pal
Javier Palacios
Tom Parker
Ezra Peisach
W. Michael Petullo
Mark Phalan
Jonathan Reams
Robert Relyea
Martin Rex
Jason Rogers
Mike Roszkowski
Guillaume Rousse
Tom Shaw
Peter Shoults
Simo Sorce
Michael Spang
Michael Ströder
Bjørn Tore Sund
Rathor Vipin
Jorgen Wahlsten
Stef Walter
Max (Weijun) Wang
John Washington
Kevin Wasserman
Margaret Wasserman
Marcus Watts
Simon Wilkinson
Nicolas Williams
Ross Wilper
Xu Qiang
Hanz van Zijst
The above is not an exhaustive list; many others have contributed in
various ways to the MIT Kerberos development effort over the years.
Other acknowledgments (for bug reports and patches) are in the
doc/CHANGES file.
|