[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: (ITS#5812) New option to disable SASL host canonicalization
------=_Part_39674_19690948.1226797622518
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
On Sat, Nov 15, 2008 at 6:20 PM, Howard Chu <hyc@symas.com> wrote:
>
> Breaking more software to use it with already broken software is, in a
> word, stupid. The standard practice for Kerberos requires you to have
> consistent forward and reverse DNS lookups. Sysadmins who are afraid to
> administer their software should either change their software or change
> their jobs.
Well .. I don't think my patch qualifies as breaking software to work with
broken software. The patch allows OpenLDAP applications to use alternative
ways for name canonicalization. At this moment this is not possible because
OpenLDAP is hard coded to canonicalize names with reverse DNS. This means I
cannot use the option that MIT Kerberos provides me to disable this (rdns =
no), as host names have already been reverse mapped by OpenLDAP before they
are passed into Kerberos.
I agree with you that reverse DNS should be correct. I just mentioned the
fact that many reverse DNS setups are broken as an example of why it can be
problematic. Another reason why canonicalization based on reverse DNS is
problematic is that it requires secure DNS to be secure. RFC4120 mentions
this:
Implementations of Kerberos and protocols based on Kerberos MUST NOT
use insecure DNS queries to canonicalize the hostname components of
the service principal names (i.e., they MUST NOT use insecure DNS
queries to map one name to another to determine the host part of the
principal name with which one is to communicate).
The same RFC recommends in fact that applications do not canonicalize host
names at all:
To maximize interoperability and security, applications SHOULD
provide security
mechanisms with names that result from folding the user- entered name to
lowercase without performing any other modifications or canonicalization.
My patch implements this behaviour, as an option.
Regards,
Geert
------=_Part_39674_19690948.1226797622518
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
On Sat, Nov 15, 2008 at 6:20 PM, Howard Chu <span dir="ltr"><<a href="mailto:hyc@symas.com"; target="_blank">hyc@symas.com</a>></span> wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<br>
Breaking more software to use it with already broken software is, in a word, stupid. The standard practice for Kerberos requires you to have consistent forward and reverse DNS lookups. Sysadmins who are afraid to administer their software should either change their software or change their jobs.</blockquote>
<div><br>Well .. I don't think my patch qualifies as breaking software to work with broken software. The patch allows OpenLDAP applications to use alternative ways for name canonicalization. At this moment this is not possible because OpenLDAP is hard coded to canonicalize names with reverse DNS. This means I cannot use the option that MIT Kerberos provides me to disable this (rdns = no), as host names have already been reverse mapped by OpenLDAP before they are passed into Kerberos.<br>
<br>I agree with you that reverse DNS should be correct. I just mentioned the fact that many reverse DNS setups are broken as an example of why it can be problematic. Another reason why canonicalization based on reverse DNS is problematic is that it requires secure DNS to be secure. RFC4120 mentions this:<br>
<br><pre> Implementations of Kerberos and protocols based on Kerberos MUST NOT<br> use insecure DNS queries to canonicalize the hostname components of<br> the service principal names (i.e., they MUST NOT use insecure DNS<br>
queries to map one name to another to determine the host part of the<br> principal name with which one is to communicate). </pre><br>The same RFC recommends in fact that applications do not canonicalize host names at all:<br>
<br><pre> To maximize interoperability and security, applications SHOULD provide security<br> mechanisms with names that result from folding the user- entered name to<br> lowercase without performing any other modifications or canonicalization.<br>
</pre><br>My patch implements this behaviour, as an option.<br><br>Regards,<br>Geert</div></div><br>
------=_Part_39674_19690948.1226797622518--