On Thu, Jan 31, 2013 at 4:47 AM, Jaroslav Reznik <jreznik(a)redhat.com&gt; wrote: > Kerberos clients can optionally verify reverse DNS records for services that > they connect to as a way of trying to identify which realm they belong to. > However in many cases these do not exist. Kerberos should fall back to it's > default behavior in that case. Failure to do this is a common point of failure > when using kerberos. Is this basically the same as what was discussed a while back on the MIT kerberos list?[1] If so, that is really great. It was not clear to me from the feature description if this will disable rdns entirely? Does this only covers cases where a PTR record is completely missing, or does it also cover cases where the PTR record present but "incorrect" (eg. doesn't match the forward record)? I have plenty of both situations at my site :-(

Can't reply on the wiki page, FAS is throwing a 500 server error when I try to log in. On Thu, Jan 31, 2013 at 4:47 AM, Jaroslav Reznik <jreznik(a)redhat.com <mailto:jreznik@redhat.com>> wrote: = Features/LessBrittleKerberos = https://fedoraproject.org/wiki/Features/LessBrittleKerberos Feature owner(s): Stef Walter <stefw(a)redhat.com <mailto:stefw@redhat.com>> Make kerberos in Fedora simpler to use by removing some of the brittleness that are common failure points. In particular we remove the need for kerberos clients to sync their clocks, and remove the need to have reverse DNS records carefully setup for services. == Detailed description == MIT kerberos 1.11 now contains work so that clients do not have to sync their system clocks with that of the KDC. A time offset is discovered during preauth and stored along with the local credentials. This removes a common point of failure when using kerberos. One concern, would this time offset be per server on the client, e.g. if people get used to this then a group of servers may all have varyingly wrong times (e.g. server A is 10 minutes fast, server B is 34 minutes slow and server C is only off by 2 seconds).

Also mitm attacks again.

Kerberos clients can optionally verify reverse DNS records for services that they connect to as a way of trying to identify which realm they belong to. However in many cases these do not exist. Kerberos should fall back to it's default behavior in that case. Failure to do this is a common point of failure when using kerberos. would this for example cache data so that for example if the server has reverse DNS setup, then it stops woring the client warns the user (e.g. indicating a possible man in the middle attack)?