X7ROOT File Manager
Current Path:
/usr/share/doc/krb5-libs-1.15.1
usr
/
share
/
doc
/
krb5-libs-1.15.1
/
📁
..
📄
NOTICE
(59.86 KB)
📄
README
(14.77 KB)
📁
examples
Editing: README
Kerberos Version 5, Release 1.15 Release Notes The MIT Kerberos Team Copyright and Other Notices --------------------------- Copyright (C) 1985-2017 by the Massachusetts Institute of Technology and its contributors. All rights reserved. Please see the file named NOTICE for additional notices. Documentation ------------- Unified documentation for Kerberos V5 is available in both HTML and PDF formats. The table of contents of the HTML format documentation is at doc/html/index.html, and the PDF format documentation is in the doc/pdf directory. Additionally, you may find copies of the HTML format documentation online at http://web.mit.edu/kerberos/krb5-latest/doc/ for the most recent supported release, or at http://web.mit.edu/kerberos/krb5-devel/doc/ for the release under development. More information about Kerberos may be found at http://web.mit.edu/kerberos/ and at the MIT Kerberos Consortium web site http://kerberos.org/ Building and Installing Kerberos 5 ---------------------------------- Build documentation is in doc/html/build/index.html or doc/pdf/build.pdf. The installation guide is in doc/html/admin/install.html or doc/pdf/install.pdf. If you are attempting to build under Windows, please see the src/windows/README file. Reporting Bugs -------------- Please report any problems/bugs/comments by sending email to krb5-bugs@mit.edu. You may view bug reports by visiting http://krbdev.mit.edu/rt/ and using the "Guest Login" button. Please note that the web interface to our bug database is read-only for guests, and the primary way to interact with our bug database is via email. DES transition -------------- The Data Encryption Standard (DES) is widely recognized as weak. The krb5-1.7 release contains measures to encourage sites to migrate away from using single-DES cryptosystems. Among these is a configuration variable that enables "weak" enctypes, which defaults to "false" beginning with krb5-1.8. Major changes in 1.15.1 (2017-03-01) ------------------------------------ This is a bug fix release. * Allow KDB modules to determine how the e_data field of principal fields is freed * Fix udp_preference_limit when the KDC location is configured with SRV records * Fix KDC and kadmind startup on some IPv4-only systems * Fix the processing of PKINIT certificate matching rules which have two components and no explicit relation * Improve documentation krb5-1.15.1 changes by ticket ID -------------------------------- 7940 PKINIT docs only work for one-component client principals 8523 Add krbPwdPolicy attributes to kerberos.ldif 8524 Add caveats to krbtgt change documentation 8525 Fix error handling in PKINIT decode_data() 8530 KDC/kadmind explicit wildcard listener addresses do not use pktinfo 8531 KDC/kadmind may fail to start on IPv4-only systems 8532 Fix GSSAPI authind attribute name in docs 8538 Need a way to free KDB module e_data 8540 Document default realm and login authorization 8552 Add GSSAPI S4U documentation 8553 Fix PKINIT two-component matching rule parsing 8554 udp_preference_limit fails with SRV records Major changes in 1.15 (2016-12-01) ---------------------------------- Administrator experience: * Improve support for multihomed Kerberos servers by adding options for specifying restricted listening addresses for the KDC and kadmind. * Add support to kadmin for remote extraction of current keys without changing them (requires a special kadmin permission that is excluded from the wildcard permission), with the exception of highly protected keys. * Add a lockdown_keys principal attribute to prevent retrieval of the principal's keys (old or new) via the kadmin protocol. In newly created databases, this attribute is set on the krbtgt and kadmin principals. * Restore recursive dump capability for DB2 back end, so sites can more easily recover from database corruption resulting from power failure events. * Add DNS auto-discovery of KDC and kpasswd servers from URI records, in addition to SRV records. URI records can convey TCP and UDP servers and master KDC status in a single DNS lookup, and can also point to HTTPS proxy servers. * Add support for password history to the LDAP back end. * Add support for principal renaming to the LDAP back end. * Use the getrandom system call on supported Linux kernels to avoid blocking problems when getting entropy from the operating system. * In the PKINIT client, use the correct DigestInfo encoding for PKCS #1 signatures, so that some especially strict smart cards will work. Code quality: * Clean up numerous compilation warnings. * Remove various infrequently built modules, including some preauth modules that were not built by default. Developer experience: * Add support for building with OpenSSL 1.1. * Use SHA-256 instead of MD5 for (non-cryptographic) hashing of authenticators in the replay cache. This helps sites that must build with FIPS 140 conformant libraries that lack MD5. * Eliminate util/reconf and allow the use of autoreconf alone to regenerate the configure script. Protocol evolution: * Add support for the AES-SHA2 enctypes, which allows sites to conform to Suite B crypto requirements. krb5-1.15 changes by ticket ID ------------------------------ 1093 KDC could use feature to limit listening interfaces 5889 password history doesn't work with LDAP KDB 6666 some non-default plugin directories don't build in 1.8 branch 7852 kadmin.local's ktadd -norandkey does not handle multiple kvnos in the KDB 7985 Add krb5_get_init_creds_opt_set_pac_request 8065 Renaming principals with LDAP KDB deletes the principal 8277 iprop can choose wrong realm 8278 Add krb5_expand_hostname() API 8280 Fix impersonate_name to work with interposers 8295 kdb5_ldap_stash_service_password() stash file logic needs tweaking 8297 jsonwalker.py test fails 8298 Audit Test fails when system has IPV6 address 8299 Remove util/reconf 8329 Only run export-check.pl in maintainer mode 8344 Create KDC and kadmind log files with mode 0640 8345 Remove nss libk5crypto implementation 8348 Remove workaround when binding to udp addresses and pktinfo isn't supported by the system 8353 Replace MD5 use in rcache with SHA-256 8354 Only store latest keys in key history entry 8355 Add kadm5_setkey_principal_4 RPC to kadmin 8364 Add get_principal_keys RPC to kadmin 8365 Add the ability to lock down principal keys 8366 Increase initial DNS buffer size 8368 Remove hdb KDB module 8371 Improve libkadm5 client RPC thread safety 8372 Use cached S4U2Proxy tickets in GSSAPI 8374 Interoperate with incomplete SPNEGO responses 8375 Allow zero cksumtype in krb5_k_verify_checksum() 8379 Add auth indicator handling to libkdb_ldap 8381 Don't fall back to master on password read error 8386 Add KDC pre-send and post-receive KDC hooks 8388 Remove port 750 from the KDC default ports 8389 Make profile includedir accept all *.conf files 8391 Add kinit long option support for all platforms 8393 Password Expiration "Never" Inconsistently Applied 8394 Add debug message filtering to krb5_klog_syslog 8396 Skip password prompt when running ksu as root 8398 Add libk5crypto support for OpenSSL 1.1.0 8399 Unconstify some krb5 GSS OIDs 8403 kinit documentation page 8404 Remove non-DFSG documentation 8405 Work around python-ldap bug in kerberos.ldif 8412 Link correct VS2015 C libraries for debug builds 8414 Use library malloc for principal, policy entries 8418 Add libkdb function to specialize principal's salt 8419 Do not indicate deprecated GSS mechanisms 8423 Add SPNEGO special case for NTLMSSP+MechListMIC 8425 Add auth-indicator authdata module 8426 test_check_allowed_to_delegate() should free unparsed princ output 8428 Minimize timing leaks in PKINIT decryption 8429 Fix Makefile for paths containing '+' character 8434 Fix memory leak in old gssrpc authentication 8436 Update libev sources to 4.22 8446 Fix leak in key change operations 8451 Add hints for -A flag to kdestroy 8456 Add the kprop-port option to kadmind 8462 Better handle failures to resolve client keytab 8464 Set prompt type for OTP preauth prompt 8465 Improve bad password inference in kinit 8466 Rename k5-queue.h macros 8471 Change KDC error for encrypted timestamp preauth 8476 Restore recursive dump functionality 8478 usability improvements for bttest 8488 Stop generating doc/CHANGES 8490 Add aes-sha2 enctype support 8494 Add krb5_db_register_keytab() 8496 Add KDC discovery from URI records 8498 Potential memory leak in prepare_error_as() 8499 Use getrandom system call on recent Linux kernels 8500 Document krb5_kt_next_entry() requirement 8502 ret_boolean in profile_get_boolean() should be krb5_boolean * instead of int * 8504 Properly handle EOF condition on libkrad sockets 8506 PKINIT fails with PKCS#11 middlware that implements PKCS#1 V2.1 8507 Suggest unlocked iteration for mkey rollover 8508 Clarify krb5_kt_resolve() API documentation 8509 Leak in krb5_cccol_have_content with truncated ccache 8510 Update features list for 1.15 8512 Fix detection of libaceclnt for securid_sam2 8513 Add doxygen comments for RFC 8009, RFC 4757 8514 Make zap() more reliable 8516 Fix declaration without type in t_shs3.c 8520 Relicense ccapi/common/win/OldCC/autolock.hxx 8521 Allow slapd path configuration in t_kdb.py Acknowledgements ---------------- Past Sponsors of the MIT Kerberos Consortium: Apple Carnegie Mellon University Centrify Corporation Columbia University Cornell University The Department of Defense of the United States of America (DoD) Fidelity Investments Google Iowa State University MIT Michigan State University Microsoft MITRE Corporation Morgan-Stanley The National Aeronautics and Space Administration of the United States of America (NASA) Network Appliance (NetApp) Nippon Telephone and Telegraph (NTT) US Government Office of the National Coordinator for Health Information Technology (ONC) Oracle Pennsylvania State University Red Hat Stanford University TeamF1, Inc. The University of Alaska The University of Michigan The University of Pennsylvania Past and present members of the Kerberos Team at MIT: Danilo Almeida Jeffrey Altman Justin Anderson Richard Basch Mitch Berger Jay Berkenbilt Andrew Boardman Bill Bryant Steve Buckley Joe Calzaretta John Carr Mark Colan Don Davis Sarah Day Alexandra Ellwood Carlos Garay Dan Geer Nancy Gilman Matt Hancher Thomas Hardjono Sam Hartman Paul Hill Marc Horowitz Eva Jacobus Miroslav Jurisic Barry Jaspan Benjamin Kaduk Geoffrey King Kevin Koch John Kohl HaoQi Li Jonathan Lin Peter Litwack Scott McGuire Steve Miller Kevin Mitchell Cliff Neuman Paul Park Ezra Peisach Chris Provenzano Ken Raeburn Jon Rochlis Jeff Schiller Jen Selby Robert Silk Bill Sommerfeld Jennifer Steiner Ralph Swick Brad Thompson Harry Tsai Zhanna Tsitkova Ted Ts'o Marshall Vale Tom Yu The following external contributors have provided code, patches, bug reports, suggestions, and valuable resources: Ian Abbott Brandon Allbery Russell Allbery Brian Almeida Michael B Allen Heinz-Ado Arnolds Derek Atkins Mark Bannister David Bantz Alex Baule David Benjamin Thomas Bernard Adam Bernstein Arlene Berry Jeff Blaine Radoslav Bodo Sumit Bose Emmanuel Bouillon Philip Brown Michael Calmer Andrea Campi Julien Chaffraix Ravi Channavajhala Srinivas Cheruku Leonardo Chiquitto Seemant Choudhary Howard Chu Andrea Cirulli Christopher D. Clausen Kevin Coffman Simon Cooper Sylvain Cortes Ian Crowther Arran Cudbard-Bell Jeff D'Angelo Nalin Dahyabhai Mark Davies Dennis Davis Alex Dehnert Mark Deneen Günther Deschner John Devitofranceschi Roland Dowdeswell Viktor Dukhovni Jason Edgecombe Mark Eichin Shawn M. Emery Douglas E. Engert Peter Eriksson Juha Erkkilä Gilles Espinasse Ronni Feldt Bill Fellows JC Ferguson Remi Ferrand Paul Fertser William Fiveash Jacques Florent Ákos Frohner Sebastian Galiano Marcus Granado Scott Grizzard Helmut Grohne Steve Grubb Philip Guenther Dominic Hargreaves Robbie Harwood Jakob Haufe Matthieu Hautreux Jochen Hein Paul B. Henson Jeff Hodges Christopher Hogan Love Hörnquist Åstrand Ken Hornstein Henry B. Hotz Luke Howard Jakub Hrozek Shumon Huque Jeffrey Hutzelman Wyllys Ingersoll Holger Isenberg Spencer Jackson Diogenes S. Jesus Pavel Jindra Brian Johannesmeyer Joel Johnson Anders Kaseorg W. Trevor King Patrik Kis Mikkel Kruse Reinhard Kugler Tomas Kuthan Pierre Labastie Volker Lendecke Jan iankko Lieskovsky Todd Lipcon Oliver Loch Kevin Longfellow Jon Looney Nuno Lopes Ryan Lynch Roland Mainz Andrei Maslennikov Michael Mattioli Nathaniel McCallum Greg McClement Cameron Meadors Alexey Melnikov Franklyn Mendez Markus Moeller Kyle Moffett Paul Moore Keiichi Mori Michael Morony Zbysek Mraz Edward Murrell Nikos Nikoleris Felipe Ortega Michael Osipov Andrej Ota Dmitri Pal Javier Palacios Tom Parker Ezra Peisach Zoran Pericic W. Michael Petullo Mark Phalan Brett Randall Jonathan Reams Jonathan Reed Robert Relyea Martin Rex Jason Rogers Matt Rogers Nate Rosenblum Solly Ross Mike Roszkowski Guillaume Rousse Andreas Schneider Tom Shaw Jim Shi Peter Shoults Simo Sorce Michael Spang Michael Ströder Bjørn Tore Sund Joe Travaglini Tim Uglow Rathor Vipin Denis Vlasenko Jorgen Wahlsten Stef Walter Max (Weijun) Wang John Washington Stef Walter Xi Wang Kevin Wasserman Margaret Wasserman Marcus Watts Andreas Wiese Simon Wilkinson Nicolas Williams Ross Wilper Augustin Wolf David Woodhouse Tsu-Phong Wu Xu Qiang Neng Xue Zhaomo Yang Nickolai Zeldovich Hanz van Zijst Gertjan Zwartjes The above is not an exhaustive list; many others have contributed in various ways to the MIT Kerberos development effort over the years. Other acknowledgments (for bug reports and patches) are in the doc/CHANGES file.
Upload File
Create Folder