Current Path :
/
usr
/
share
/
doc
/
krb5-libs-1.10.3
/
Or
Select Your Path :
Upload File :
New :
File
Dir
//usr/share/doc/krb5-libs-1.10.3/README
Kerberos Version 5, Release 1.10 Release Notes The MIT Kerberos Team Copyright and Other Notices --------------------------- Copyright (C) 1985-2012 by the Massachusetts Institute of Technology and its contributors. All rights reserved. Please see the file named NOTICE for additional notices. MIT Kerberos is a project of the MIT Kerberos Consortium. For more information about the Kerberos Consortium, see http://kerberos.org/ For more information about the MIT Kerberos software, see http://web.mit.edu/kerberos/ People interested in participating in the MIT Kerberos development effort should visit http://k5wiki.kerberos.org/ Building and Installing Kerberos 5 ---------------------------------- The first file you should look at is doc/install-guide.ps; it contains the notes for building and installing Kerberos 5. The info file krb5-install.info has the same information in info file format. You can view this using the GNU emacs info-mode, or by using the standalone info file viewer from the Free Software Foundation. This is also available as an HTML file, install.html. Other good files to look at are admin-guide.ps and user-guide.ps, which contain the system administrator's guide, and the user's guide, respectively. They are also available as info files kerberos-admin.info and krb5-user.info, respectively. These files are also available as HTML files. If you are attempting to build under Windows, please see the src/windows/README file. Reporting Bugs -------------- Please report any problems/bugs/comments using the krb5-send-pr program. The krb5-send-pr program will be installed in the sbin directory once you have successfully compiled and installed Kerberos V5 (or if you have installed one of our binary distributions). If you are not able to use krb5-send-pr because you haven't been able compile and install Kerberos V5 on any platform, you may send mail to krb5-bugs@mit.edu. Please keep in mind that unencrypted e-mail is not secure. If you need to report a security vulnerability, or send sensitive information, please PGP-encrypt it to krbcore-security@mit.edu. You may view bug reports by visiting http://krbdev.mit.edu/rt/ and logging in as "guest" with password "guest". DES transition -------------- The Data Encryption Standard (DES) is widely recognized as weak. The krb5-1.7 release contains measures to encourage sites to migrate away from using single-DES cryptosystems. Among these is a configuration variable that enables "weak" enctypes, which defaults to "false" beginning with krb5-1.8. Major changes in 1.10.3 ----------------------- This is a bugfix release. * Fix KDC uninitialized pointer vulnerabilities that could lead to a denial of service [CVE-2012-1014] or remote code execution [CVE-2012-1015]. * Correctly use default_tgs_enctypes instead of default_tkt_enctypes for TGS requests. krb5-1.10.3 changes by ticket ID -------------------------------- 7150 Does not build when CPPFLAGS=-DDEBUG is set. 7155 default_tgs_enctypes not used for client TGS enctypes 7185 Fix crash on invalid DIR ccache primary file 7197 Translate WinSock errors to Posix counterparts 7198 Implement switch_to for ccapiv3 7199 Add krb5int_cc_user_set_default_name 7200 Always recreate acl files during dejagnu tests 7201 Handle huge /bin directories in libdb2 test 7203 kfw add preauth_sam2 to OBJS for windows build 7204 KFW win-mac.h fixes 7206 Use %i, not %s to Tprintf GetLastError() 7207 Don't use syslog / LOG_DEBUG when they don't exist 7208 __func__ -> __FUNCTION__ in disp_status.c 7209 Define USE_CCAPI_V3 in krb5/ccache on windows 7210 Remove the UNICODE defines from wshelper 7212 MSLSA Don't use lstrcpy on ANSI strings 7213 Implement cccol iterators for mslsa 7214 krb5_stdccv3_get_principal error handling fixup 7215 Remove DISABLE_TRACING from windows build 7226 Fix KDC uninit ptrs [CVE-2012-1014 CVE-2012-1015] 7227 Fix oid set construction in gss_inquire_cred() 7228 Further fixes for WSA/Posix error translation 7230 Add missing quote to install-windows 7231 Regression tests for CVE-2012-1014, CVE-2012-1015 Major changes in 1.10.2 ----------------------- This is a bugfix release. * Fix an interop issue with Windows Server 2008 R2 Read-Only Domain Controllers. * Update a workaround for a glibc bug that would cause DNS PTR queries to occur even when rdns = false. * Fix a kadmind denial of service issue (null pointer dereference), which could only be triggered by an administrator with the "create" privilege. [CVE-2012-1013] krb5-1.10.2 changes by ticket ID -------------------------------- 7095 Build system uses @localedir@ without requiring autoconf 2.60 7099 Decrypting history key entries can fail after 1.8 upgrade 7119 Preauth fails for second AS request in a krb5 context 7120 Use correct name-type in TGS-REQs for 2008R2 RODCs 7124 krb5_sname_to_principal canonicalization should work with IPv6-only hosts 7127 Can't change password without default_realm 7136 S4U2Self using kvno broken in 1.10.1, but not in 1-9.3 7143 krb5_set_trace_filename not exported 7148 Export gss_mech_krb5_wrong from libgssapi_krb5 7152 Null pointer deref in kadmind [CVE-2012-1013] Major changes in 1.10.1 ----------------------- This is a bugfix release. * Fix access controls for KDB string attributes [CVE-2012-1012] * Make the ASN.1 encoding of key version numbers interoperate with Windows Read-Only Domain Controllers * Avoid generating spurious password expiry warnings in cases where the KDC sends an account expiry time without a password expiry time. krb5-1.10.1 changes by ticket ID -------------------------------- 7074 workaround for Solaris 8 lacking isblank 7081 Don't use stack variable address in as_req state 7082 Various lookaside cache fixes 7084 Don't check mech in krb5_gss_inquire_cred_by_mech 7087 krb5_gss_get_name_attribute fails to set display_value 7088 Fix uninitialized variable warning in trval.c 7089 Initialize gss_get_name_attribute output buffers 7092 kvno ASN.1 encoding interop with Windows RODCs 7093 Access controls for string RPCs [CVE-2012-1012] 7096 Fix KDB iteration when callback does write calls 7098 Fix spurious password expiry warning Major changes in 1.10 --------------------- Additional background information on these changes may be found at http://k5wiki.kerberos.org/wiki/Release_1.10 and http://k5wiki.kerberos.org/wiki/Category:Release_1.10_projects Code quality: * Fix MITKRB5-SA-2011-006 and MITKRB5-SA-2011-007 KDC denial of service vulnerabilities [CVE-2011-1527 CVE-2011-1528 CVE-2011-1529 CVE-2011-1530]. * Update the Fortuna implementation to more accurately implement the description in _Cryptography Engineering_, and make it the default PRNG. * Add an alternative PRNG that relies on the OS native PRNG. Developer experience: * Add the ability for GSSAPI servers to use any keytab key for a specified service, if the server specifies a host-based name with no hostname component. * In the build system, identify the source files needed for per-message processing within a kernel and ensure that they remain independent. * Allow rd_safe and rd_priv to ignore the remote address. * Rework KDC and kadmind networking code to use an event loop architecture. * Add a plugin interface for providing configuration information. Administrator experience: * Add more complete support for renaming principals. * Add the profile variable ignore_acceptor_hostname in libdefaults. If set, GSSAPI will ignore the hostname component of acceptor names supplied by the server, allowing any keytab key matching the service to be used. * Add support for string attributes on principal entries. * Allow password changes to work over NATs. End-user experience: * Add the DIR credential cache type, which can hold a collection of credential caches. * Enhance kinit, klist, and kdestroy to support credential cache collections if the cache type supports it. * Add the kswitch command, which changes the selected default cache within a collection. * Add heuristic support for choosing client credentials based on the service realm. * Add support for $HOME/.k5identity, which allows credential choice based on configured rules. * Add support for localization. (No translations are provided in this release, but the infrastructure is present for redistributors to supply them.) Protocol evolution: * Make PKINIT work with FAST in the client library. krb5-1.10 changes by ticket ID ------------------------------ 6118 rename principals 6323 kadmin: rename support 6430 Avoid looping when preauth can't be generated 6617 uninitialized values used in mkey-migration code 6732 checks for openpty() aren't made using -lutil 6770 kg_unseal leads to overlap of source and desitination in memcpy... 6813 memory leak in gss_accept_sec_context 6814 Improve kdb5_util load locking and recovery 6816 potential memory leak in spnego 6817 potential null dereference in gss mechglue 6835 accept_sec_context RFC4121 support bug in 1.8.3 6851 pkinit can't parse some valid cms messages 6854 kadmin's ktremove can remove wrong entries when removing kvno 0 6855 Improve acceptor name flexibility 6857 missing ifdefs around IPv6 code 6858 Assume ELF on FreeBSD if objformat doesn't exist 6863 memory leak on SPNEGO error path 6868 Defer hostname lookups in krb5_sendto_kdc 6872 Fix memory leak in t_expire_warn 6874 Fortuna as default PRNG 6878 Add test script for user2user programs 6887 Use first principal in keytab when verifying creds 6890 Implement draft-josefsson-gss-capsulate 6891 Add gss_userok and gss_pname_to_uid 6892 Prevent bleed-through of mechglue symbols into loaded mechs 6893 error codes from error responses can be discarded when there's e-data 6894 More sensical mech selection for gss_acquire_cred/accept_sec_context 6895 gss_duplicate_name SPI for SPNEGO 6896 Allow anonymous name to be imported with empty name buffer 6897 Default principal name in the acceptor cred corresponds to first entry in associated keytab. 6898 Set correct minor_status value in call to gss_display_status. 6902 S4U impersonated credential KRB5_CC_NOT_FOUND 6904 Install k5login(5) as well as .k5login(5) 6905 support poll() in sendto_kdc.c 6909 Kernel subset 6910 Account lockout policy parameters not documented 6911 Account lockout policy options time format 6914 krb5-1.9.1 static compile error +preliminary patch (fwd) 6915 klist -s trips over referral entries 6918 Localize user interface strings using gettext 6921 Convert preauth_plugin.h to new plugin framework 6922 Work around glibc getaddrinfo PTR lookups 6923 Use AI_ADDRCONFIG for more efficient getaddrinfo 6924 Fix multiple libkdb_ldap memory leaks 6927 chpass_util.c improvements 6928 use timegm() for krb5int_gmt_mktime() when available 6929 Pluggable configuration 6931 Add libedit/readline support to ss. 6933 blocking recv caused our server to hang 6934 don't require a default realm 6936 multiple mechanisms and spnego_gss_init_sec_context 6944 gss_acquire_cred erroneous failure and potential segfault for caller 6945 spnego_gss_acquire_cred_impersonate_name incorrect usage of impersonator_cred_handle 6951 assertion failure when connections fail in service_fds() 6953 Add the DIR ccache type 6954 Add new cache collection APIs 6955 Remove unneeded cccol behaviors 6956 Add ccache collection support to tools 6957 Add krb5_cc_select() API and pluggable interface 6958 Make gss-krb5 use cache collection 6961 Support pkinit: SignedData with no signers (KDC) 6962 pkinit: client: Use SignedData for anonymous 6964 Support special salt type in default krb5_dbe_cpw. 6965 Remove CFLAGS and external deps from krb5-config --libs 6966 Eliminate domain-based client realm walk 6968 [PATCH] Man page fixes 6969 Create e_data as pa_data in KDC interfaces. 6971 Use type-safe callbacks in preauth interface 6974 Make krb5_pac_sign public 6975 Add PKINIT NSS support 6976 Hide gak_fct interface and arguments in clpreauth 6977 Install krb5/preauth_plugin.h 6978 Allow rd_priv/rd_safe without remote address 6979 Allow password changes over NATs 6980 Ensure termination in Windows vsnprintf wrapper 6981 SA-2011-006 KDC denial of service [CVE-2011-1527 CVE-2011-1528 CVE-2011-1529] 6987 Fix krb5_cc_set_config 6988 Fix handling of null edata method in KDC preauth 6989 fix tar invocation in mkrel 6992 Make krb5_find_authdata public 6994 Fix intermediate key length in hmac-md5 checksum 6995 Initialize typed_e_data in as_req_state 6996 Make krb5_check_clockskew public 6997 don't build po/ if msgfmt is missing 6999 compile warnings, mininum version check for pkinit (NSS code paths) 7000 Exit on error in kadmind kprop child 7002 verto sshould have a pointer to upstream sources and be in NOTICE 7003 Fix month/year units in getdate 7006 Fix format string for TRACE_INIT_CREDS_SERVICE 7014 Fix com_err.h dependencies in gss-kernel-lib 7015 Add plugin interface_names entry for ccselect 7017 Simplify and fix kdcpreauth request_body callback 7018 Update verto to 0.2.2 release 7019 Make verto context available to kdcpreauth modules 7020 reading minor error message doesn't work for the IAKERB mech 7021 Fix failure interval of 0 in LDAP lockout code 7023 Clean up client-side preauth error data handling 7027 FAST PKINIT 7029 Fix --with-system-verto without pkg-config 7030 Ldap dependency for parallel builds 7033 krb5 1.10 KRB5_PADATA_ENC_TIMESTAMP isn't working 7034 mk_cred: memory management 7035 krb5_lcc_store() now ignores config credentials 7036 Fix free ofuninitialized memory in sname_to_princ 7037 Use LsaDeregisterLogonProcess(), not CloseHandle() 7038 Added support for loading of Krb5.ini from Windows APPDATA 7039 Handle TGS referrals to the same realm 7042 SA-2011-007 KDC null pointer deref in TGS handling [CVE-2011-1530] 7049 Fix subkey memory leak in krb5_get_credentials 7050 KfW changes for krb5-1.10 7051 krb5_server_decrypt_ticket_keytab wrongly succeeds 7053 Verify acceptor's mech in SPNEGO initiator 7055 Rename Table of Contents.hhc 7057 Krb5 1.9.x does not build on Solaris 8 - Implicit function declaration error 7060 Convert securid module edata method 7065 delete duplicate NOTICE file 7067 documentation license to CC-BY-SA 3.0 Unported 7077 LIBS should not include PKINIT_CRYPTO_IMPL_LIBS 7078 Use INSTALL_DATA to install message catalogues Acknowledgements ---------------- Past and present Sponsors of the MIT Kerberos Consortium: Apple Carnegie Mellon University Centrify Corporation Columbia University Cornell University The Department of Defense of the United States of America (DoD) Fidelity Investments Google Iowa State University MIT Michigan State University Microsoft The National Aeronautics and Space Administration of the United States of America (NASA) Network Appliance (NetApp) Nippon Telephone and Telegraph (NTT) Oracle Pennsylvania State University Red Hat Stanford University TeamF1, Inc. The University of Alaska The University of Michigan The University of Pennsylvania Past and present members of the Kerberos Team at MIT: Danilo Almeida Jeffrey Altman Justin Anderson Richard Basch Mitch Berger Jay Berkenbilt Andrew Boardman Bill Bryant Steve Buckley Joe Calzaretta John Carr Mark Colan Don Davis Alexandra Ellwood Carlos Garay Dan Geer Nancy Gilman Matt Hancher Thomas Hardjono Sam Hartman Paul Hill Marc Horowitz Eva Jacobus Miroslav Jurisic Barry Jaspan Benjamin Kaduk Geoffrey King Kevin Koch John Kohl HaoQi Li Jonathan Lin Peter Litwack Scott McGuire Steve Miller Kevin Mitchell Cliff Neuman Paul Park Ezra Peisach Chris Provenzano Ken Raeburn Jon Rochlis Jeff Schiller Jen Selby Robert Silk Bill Sommerfeld Jennifer Steiner Ralph Swick Brad Thompson Harry Tsai Zhanna Tsitkova Ted Ts'o Marshall Vale Tom Yu The following external contributors have provided code, patches, bug reports, suggestions, and valuable resources: Ian Abbott Brandon Allbery Russell Allbery Brian Almeida Michael B Allen Heinz-Ado Arnolds Derek Atkins Mark Bannister David Bantz Alex Baule Adam Bernstein Arlene Berry Jeff Blaine Radoslav Bodo Emmanuel Bouillon Michael Calmer Julien Chaffraix Ravi Channavajhala Srinivas Cheruku Leonardo Chiquitto Howard Chu Andrea Cirulli Christopher D. Clausen Kevin Coffman Simon Cooper Sylvain Cortes Nalin Dahyabhai Mark Davies Dennis Davis Mark Deneen Roland Dowdeswell Jason Edgecombe Mark Eichin Shawn M. Emery Douglas E. Engert Peter Eriksson Juha Erkkilä Ronni Feldt Bill Fellows JC Ferguson William Fiveash Ákos Frohner Sebastian Galiano Marcus Granado Scott Grizzard Helmut Grohne Steve Grubb Philip Guenther Dominic Hargreaves Jakob Haufe Paul B. Henson Jeff Hodges Christopher Hogan Love Hörnquist Åstrand Ken Hornstein Henry B. Hotz Luke Howard Jakub Hrozek Shumon Huque Jeffrey Hutzelman Wyllys Ingersoll Holger Isenberg Pavel Jindra Joel Johnson W. Trevor King Mikkel Kruse Volker Lendecke Jan iankko Lieskovsky Oliver Loch Kevin Longfellow Ryan Lynch Nathaniel McCallum Greg McClement Cameron Meadors Alexey Melnikov Franklyn Mendez Markus Moeller Kyle Moffett Paul Moore Keiichi Mori Michael Morony Zbysek Mraz Edward Murrell Nikos Nikoleris Felipe Ortega Andrej Ota Dmitri Pal Javier Palacios Tom Parker Ezra Peisach W. Michael Petullo Mark Phalan Jonathan Reams Robert Relyea Martin Rex Jason Rogers Mike Roszkowski Guillaume Rousse Tom Shaw Peter Shoults Simo Sorce Michael Spang Michael Ströder Bjørn Tore Sund Rathor Vipin Jorgen Wahlsten Stef Walter Max (Weijun) Wang John Washington Kevin Wasserman Margaret Wasserman Marcus Watts Simon Wilkinson Nicolas Williams Ross Wilper Xu Qiang Hanz van Zijst The above is not an exhaustive list; many others have contributed in various ways to the MIT Kerberos development effort over the years. Other acknowledgments (for bug reports and patches) are in the doc/CHANGES file.
