From sacadmin Tue Jun 12 11:44:33 2007 Received: from sfbaymail1sca.SFBay.Sun.COM (sfbaymail1sca.SFBay.Sun.COM [129.145.154.35]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CIiX1k012634 for ; Tue, 12 Jun 2007 11:44:33 -0700 (PDT) Received: from sca-es-mail-1.sun.com (sca-es-mail-1.Sun.COM [192.18.43.132]) by sfbaymail1sca.SFBay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5CIh34u025744 for ; Tue, 12 Jun 2007 11:43:03 -0700 (PDT) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id l5CIgwV7021793 for ; Tue, 12 Jun 2007 11:42:58 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JJJ00E01BJ6PZ00@fe-sfbay-10.sun.com> (original mail from John.Plocher@Sun.COM) for psarc-record@sac.sfbay.sun.com; Tue, 12 Jun 2007 11:42:58 -0700 (PDT) Received: from [129.146.58.87] by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JJJ00FR6DBEROA0@fe-sfbay-10.sun.com> for psarc-record@sac.sfbay.sun.com; Tue, 12 Jun 2007 11:42:50 -0700 (PDT) Date: Tue, 12 Jun 2007 11:42:38 -0700 From: John Plocher Subject: kdcmgr utility [PSARC/2007/335 FastTrack timeout 06/14/2007] Sender: John.Plocher@Sun.COM To: psarc-record@sac.sfbay.sun.com Message-id: <466EE91E.1010109@Sun.Com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT User-Agent: Thunderbird 1.5.0.12 (Macintosh/20070509) Status: RO Content-Length: 11243 -------- Original Message -------- Date: Fri, 08 Jun 2007 11:14:41 -0700 (PDT) From: Wyllys Ingersoll Subject: kdcmgr utility [PSARC/2007/335 FastTrack timeout 06/14/2007] To: PSARC-ext@sun.com Template Version: @(#)sac_nextcase 1.61 05/24/07 SMI This information is Copyright 2007 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: kdcmgr utility 1.2. Name of Document Author/Supplier: Author: Shawn Emery 1.3 Date of This Document: 08 June, 2007 4. Technical Description ABSTRACT -------- Some customers find the manual way of configuring Key Distribution Center (KDC) servers tedious and is prone to error for them. This represents dissatisfaction and increase in support costs to Sun. But more importantly, administrators have come to expect simple interfaces for configuring servers. This project will provide a CLI to administrators for configuring Kerberos Key Distribution Center (KDC) servers. The CLI will supply options for configuring a master KDC and slave KDC. PROPOSAL -------- This will be implemented in a scripting language (ksh) that will make calls to Kerberos utilities to configure the master and slave KDC servers. These Kerberos and system utilities include: kdb5_util(1M) kadmin(1M) kadmin.local(1M) svcadm(1M) dig(1M) ping(1M) An alternative would be to make a GUI for configuring the KDC servers using Java. However, this would require more resources as it would take longer to implement. Most customers could still benefit from an interactive script. The kdcmgr script will perform basic security checks and warn the administrator if it detects a problem. Given the hundreds of possible KDC configurations it is impossible to provide a simple interface to handle all of these. The assumption is that this utility will provide configurations for a simple, but common subset. DOCUMENTATION ------------- kdcmgr(1M) is the new CLI for configuring KDC servers. It has an interactve interface, but with options that can limit the interaction. A new man page will be created for kdcmgr(1M): System Administration Commands kdcmgr(1M) NAME kdcmgr - set up a Kerberos Key Distribution Center (KDC) SYNOPSIS /usr/sbin/kdcmgr [ -a admprincipal ] [ -e enctype ] [ -h ] [ -p pwfile ] [ -r realm ] subcommand DESCRIPTION The kdcmgr utility can be used to configure the following: o Configure a master Key Distribution Center (KDC) server. o Configure a slave KDC. Assumes that a master KDC has already been configured. The default propagation method configured is incremental propagation, see kpropd(1M). o Specify a list of slave KDCs to configure service principals and create access control list for these slaves on the master KDC. If none of the options are provided then the user is prompted for the required information. When sufficient options are provided the user is still prompted for the password to generate the master key and the password for the administrative principal, unless the -p pwfile option was provided. The utility needs to be run as root on the server from which it is invoked. Note that kdcmgr requires the user to enter sensitive information, such as the password used to generate the database's master key and the password for the administrative principal. Great care must be taken to ensure that the connection to the server is secured over the network, by using a protocol such as ssh. Great care must also be made when selecting the administrative and master key passwords. They should be based off of non-dictionary words and a long string of characters consisting of all of the following character classes: Special characters (e.g. !@#$%^&*) Numerals (0-9) Upper case letters Lower case letters OPTIONS -a admprincipal When creating a master KDC, the -a argument specifies the administrative principal, admprincipal, that will be created. When creating a slave KDC, admprincipal is used to authenticate as the administrative principal. If -a is not specified then the suggested default adminstrative principal name would be the output of logname(1) concatenated with "/admin". -e enctype Specifies the encryption type to be used when creating the key for the master key, which is used to encrypt all principal keys in the database. The set of valid encryption types used here are described in krb5.conf(4) under the permitted_enctypes option. Note that the encryption type specified here must be supported on all KDCs or else they will not be able to decrypt any of the principal keys. Solaris 9 or earlier releases only support the des-cbc-crc encryption type for the master key. Therefore if any of the master or slave KDCs are of these older releases then "-e des-cbc-crc" would need to be specified on all KDCs configured with kdcmgr. The default encryption type is aes128-cts-hmac-sha1-96. -h Prints out the usage information for the kdcmgr utility. -p pwfile Provides the location of the password file that contains the password used to create the administrative principal and/or master key. WARNING: This option should be used with great care to make sure that this pwfile is accessible only by the root user and on a local file system. Once the KDC has been configured removal of the file should be performed. -r realm Set the default realm for this server. If the -r option is not specified then kdcmgr will attempt to obtain the machine's local domain name by canonicalizing the machine's host name through DNS and using the return value to determine the domain name of the local machine. If successful then the domain name will be upper cased and suggested as the default realm name. SUBCOMMANDS The following subcommands are supported: create [ master ] create [ -m masterkdc ] slave Will create a KDC. If no option is specified an attempt to create a master KDC will be made. create [ master ] Create a master KDC. Upon successful configuration the krb5kdc(1M) and kadmind(1M) are enabled on the machine create [ -m masterkdc ] slave Configures a slave KDC. After configuration the krb5kdc(1M) and kpropd(1M) services are enabled on the machine. masterkdc specifies the master KDC to authenticate and perform administrative tasks with. If -m is not provided the user will be prompted for a master KDC host name to use. Note that kdcmgr will need to be executed separately on each of the slaves using kdcmgr's "create slave" subcommand. destroy Remove all Kerberos configuration and database files associated with the KDC server. A confirmation is required before these files are deleted. status Determines the role of the KDC, master or slave, and outputs this and the state of the associated processes, such as: krb5kdc(1M) kadmind(1M) kpropd(1M) The subcommand will also display information on incremental propagation if the configuration has this enabled, and any issues with any dependent files. EXAMPLES Example 1: Setting up a master KDC The following command will configure a master KDC with the administrative principal user1/admin and with the EXAMPLE.COM realm name: $ kdcmgr -a user1/admin -r EXAMPLE.COM create Note that a password will be required to assign to the user1/admin principal that is created. The password for the master key will also need to be provided. Example 2: Setting up a slave KDC The following command will configure a slave KDC, authenticate with the administrative principal user1/admin, specifies kdc1 as the master, and use the EXAMPLE.COM realm name: $ kdcmgr -a user1/admin -r EXAMPLE.COM create -m kdc1 slave Note that the correct password for user1/admin will need to be entered and that the master KDC would have already been created before this. The correct password for the master key will also be required. FILES /etc/krb5/krb5.conf Main Kerberos configuration file. /etc/krb5/kdc.conf KDC configuration, used by both master and slave servers. /etc/krb5/krb5.keytab Default location of the local host's service keys. /etc/krb5/kadm5.acl Kerberos administrative access control list (ACL). /etc/krb5/kadm5.keytab Service keys specific to kadmind(1M). /var/krb5/principal Kerberos principal database. /var/krb5/principal.kadm5 Kerberos policy database. /etc/krb5/kpropd.acl Used by slaves to indicate which server to receive updates from. ATTRIBUTES See attributes(5) for descriptions of the following attributes: ____________________________________________________________ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | |_____________________________|_____________________________| | Availability | SUNWkdcu | |_____________________________|_____________________________| | Interface Stability | See below | |_____________________________|_____________________________| The command line interface (CLI) is Uncommitted. The CLI output is Not an Interface. SEE ALSO krb5.conf(4), kdc.conf(4), krb5kdc(1M), kpropd(1M), kadmind(1M), kdb5_util(1M), kadmin(1M), kadmin.local(1M), svcadm(1M), dig(1M), ping(1M) INTERFACE STABILITY AND RELEASE BINDINGS ---------------------------------------- Interface Stability Release Binding kdcmgr(1M) Committed micro/patch 6. Resources and Schedule: 6.4. Product Approval Committee requested information: 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: FastTrack 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: FastTrack ---- end of original message ---- From gww@eng.sun.com Wed Jun 13 08:04:36 2007 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5DF4ags008170 for ; Wed, 13 Jun 2007 08:04:36 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5DF31gb019156 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 13 Jun 2007 08:03:02 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJK00C2ZXT16100@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 13 Jun 2007 08:03:01 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJK00KO4XT1NDA0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 13 Jun 2007 08:03:01 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5DF31NI026935; Wed, 13 Jun 2007 08:03:01 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id l5DF5ajl011759; Wed, 13 Jun 2007 08:05:36 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id l5DF5aLw011758; Wed, 13 Jun 2007 08:05:36 -0700 (PDT) Date: Wed, 13 Jun 2007 08:05:36 -0700 (PDT) From: Gary Winiger Subject: Re: kdcmgr utility [PSARC/2007/335 FastTrack timeout 06/14/2007] To: PSARC-ext@sun.com Cc: wyllys@borg.sfbay.sun.com Message-id: <200706131505.l5DF5aLw011758@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 1973 > ABSTRACT > -------- > > Some customers find the manual way of configuring Key Distribution Center > (KDC) servers tedious and is prone to error for them. This represents > dissatisfaction and increase in support costs to Sun. But more importantly, > administrators have come to expect simple interfaces for configuring servers. > > This project will provide a CLI to administrators for configuring > Kerberos Key Distribution Center (KDC) servers. The CLI will supply > options for configuring a master KDC and slave KDC. > > PROPOSAL > -------- > > This will be implemented in a scripting language (ksh) that will > make calls to Kerberos utilities to configure the master and slave > KDC servers. These Kerberos and system utilities include: > > kdb5_util(1M) Though I see no mention of it in this case, I presume this new command will be added to the appropritat Rights Profile (Kerberos Server Management?). > kadmin(1M) > kadmin.local(1M) > svcadm(1M) Speaking of Rights Profiles, it seems that appropriate privileges are not provided to manage the services. Please log a P3 bug or fix with this change. > The utility needs to be run as root on the server from which it is > invoked. Note that kdcmgr requires the user to enter sensitive Can we please stop talking about Root and start talking about RBAC. RBAC has been shipping since S8. > -p pwfile > > Provides the location of the password file that contains the password > used to create the administrative principal and/or master key. > > WARNING: This option should be used with great care to make sure > that this pwfile is accessible only by the root user and on a Ditto. How about "... is accessible only to authorized users and ..." > local file system. Once the KDC has been configured removal of > the file should be performed. Gary.. From gww@eng.sun.com Wed Jun 13 08:13:21 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5DFDKgt008340 for ; Wed, 13 Jun 2007 08:13:20 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5DFBW49011395 for <@sunmail3mpk.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 13 Jun 2007 16:11:48 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJK0030BY7IIX00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 13 Jun 2007 08:11:42 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJK000NVY7HAS40@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 13 Jun 2007 08:11:41 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5DFBfvq027731; Wed, 13 Jun 2007 08:11:41 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id l5DFEG2V011791; Wed, 13 Jun 2007 08:14:16 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id l5DFEGp6011790; Wed, 13 Jun 2007 08:14:16 -0700 (PDT) Date: Wed, 13 Jun 2007 08:14:16 -0700 (PDT) From: Gary Winiger Subject: Re: kdcmgr utility [PSARC/2007/335 FastTrack timeout 06/14/2007] To: PSARC-ext@sun.com, gww@eng.sun.com Cc: wyllys@borg.sfbay.sun.com Message-id: <200706131514.l5DFEGp6011790@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-Sun-Charset: US-ASCII X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 737 > > PROPOSAL > > -------- > > > > This will be implemented in a scripting language (ksh) that will > > make calls to Kerberos utilities to configure the master and slave > > KDC servers. These Kerberos and system utilities include: > > > > kdb5_util(1M) > > Though I see no mention of it in this case, I presume > this new command will be added to the appropritat Rights Profile > (Kerberos Server Management?). > > > kadmin(1M) > > kadmin.local(1M) > > svcadm(1M) > > Speaking of Rights Profiles, it seems that appropriate privileges ^^^^^^^^^^ authorizations > are not provided to manage the services. Please log a P3 bug > or fix with this change. Gary.. From Shawn.Emery@Sun.COM Wed Jun 13 12:08:46 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5DJ8jX5020383 for ; Wed, 13 Jun 2007 12:08:46 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5DJ75rv026862; Thu, 14 Jun 2007 03:07:12 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJL00D0P93XO400@nwk-avmta-2.sfbay.sun.com>; Wed, 13 Jun 2007 12:07:09 -0700 (PDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJL00AUN93XUK30@nwk-avmta-2.sfbay.sun.com>; Wed, 13 Jun 2007 12:07:09 -0700 (PDT) Received: from fe-amer-03.sun.com ([192.18.108.177]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id l5DJ79kW001548; Wed, 13 Jun 2007 19:07:09 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0JJL004018GANY00@mail-amer.sun.com> (original mail from Shawn.Emery@Sun.COM); Wed, 13 Jun 2007 13:07:09 -0600 (MDT) Received: from [129.150.48.17] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0JJL008HY93S3VD3@mail-amer.sun.com>; Wed, 13 Jun 2007 13:07:05 -0600 (MDT) Date: Wed, 13 Jun 2007 13:06:09 -0600 From: Shawn M Emery Subject: Re: kdcmgr utility [PSARC/2007/335 FastTrack timeout 06/14/2007] In-reply-to: <46703EBB.5090405@sun.com> Sender: Shawn.Emery@Sun.COM To: PSARC-ext@Sun.COM Cc: Kerberos-Core team Message-id: <46704021.9070308@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <46703EBB.5090405@sun.com> User-Agent: Thunderbird 2.0.0.0 (X11/20070419) Status: RO Content-Length: 2266 gww wrote: >> ABSTRACT >> -------- >> >> Some customers find the manual way of configuring Key Distribution >> Center >> (KDC) servers tedious and is prone to error for them. This represents >> dissatisfaction and increase in support costs to Sun. But more >> importantly, >> administrators have come to expect simple interfaces for configuring >> servers. >> >> This project will provide a CLI to administrators for configuring >> Kerberos Key Distribution Center (KDC) servers. The CLI will supply >> options for configuring a master KDC and slave KDC. >> >> PROPOSAL >> -------- >> >> This will be implemented in a scripting language (ksh) that will >> make calls to Kerberos utilities to configure the master and slave >> KDC servers. These Kerberos and system utilities include: >> >> kdb5_util(1M) > > Though I see no mention of it in this case, I presume > this new command will be added to the appropritat Rights Profile > (Kerberos Server Management?). Yes, this can be implemented. >> kadmin(1M) >> kadmin.local(1M) >> svcadm(1M) > > Speaking of Rights Profiles, it seems that appropriate privileges > are not provided to manage the services. Please log a P3 bug > or fix with this change. This will be fixed in the changes for: 6396157 svc:/system/network/krb5kdc needs service level properties for config >> The utility needs to be run as root on the server from which >> it is >> invoked. Note that kdcmgr requires the user to enter sensitive > > Can we please stop talking about Root and start talking about > RBAC. RBAC has been shipping since S8. Done. >> -p pwfile >> >> Provides the location of the password file that contains >> the password >> used to create the administrative principal and/or master >> key. >> >> WARNING: This option should be used with great care to >> make sure >> that this pwfile is accessible only by the root user and >> on a > > Ditto. How about "... is accessible only to authorized users and ..." Done. >> local file system. Once the KDC has been configured >> removal of >> the file should be performed. -- Shawn. From gww@eng.sun.com Wed Jun 13 12:48:12 2007 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5DJmCbv021136 for ; Wed, 13 Jun 2007 12:48:12 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5DJkDw6015558; Wed, 13 Jun 2007 13:46:14 -0600 (MDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJL0010JAXSW600@brm-avmta-1.central.sun.com>; Wed, 13 Jun 2007 13:46:40 -0600 (MDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJL00I4MAXQUL60@brm-avmta-1.central.sun.com>; Wed, 13 Jun 2007 13:46:39 -0600 (MDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5DJkcxJ001192; Wed, 13 Jun 2007 12:46:38 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id l5DJnDgK012570; Wed, 13 Jun 2007 12:49:13 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id l5DJnD7a012569; Wed, 13 Jun 2007 12:49:13 -0700 (PDT) Date: Wed, 13 Jun 2007 12:49:13 -0700 (PDT) From: Gary Winiger Subject: Re: kdcmgr utility [PSARC/2007/335 FastTrack timeout 06/14/2007] To: PSARC-ext@sun.com, Shawn.Emery@sun.com Cc: krb5-core@sun.com Message-id: <200706131949.l5DJnD7a012569@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-Sun-Charset: US-ASCII X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 32 > gww wrote: Thanks. Gary.. From stacey.marshall@sun.com Thu Jun 14 09:54:44 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5EGshOX024071 for ; Thu, 14 Jun 2007 09:54:44 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5EGr7fj001452 for <@newsunmail1brm.central.sun.com:PSARC-ext@sun.com>; Thu, 14 Jun 2007 17:53:09 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJM00011XKL3Y00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 14 Jun 2007 10:53:09 -0600 (MDT) Received: from dm-uk-01.uk.sun.com ([129.156.101.115]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJM00J1KXKJ6440@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 14 Jun 2007 10:53:08 -0600 (MDT) Received: from serinus.UK.Sun.COM (serinus.UK.Sun.COM [129.156.173.208]) by dm-uk-01.uk.sun.com (8.13.7+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5EGr44V009755; Thu, 14 Jun 2007 17:53:04 +0100 (BST) Received: from [129.156.173.199] (estale [129.156.173.199]) by serinus.UK.Sun.COM (8.13.7+Sun/8.13.7/CTE 3.0) with ESMTP id l5EGr4RJ026738; Thu, 14 Jun 2007 17:53:04 +0100 (BST) Date: Thu, 14 Jun 2007 17:53:04 +0100 From: Stacey Marshall Subject: Re: kdcmgr utility [PSARC/2007/335 FastTrack timeout 06/14/2007] In-reply-to: <200706081814.l58IEfnr011695@borg.SFBay.Sun.COM> To: Wyllys Ingersoll Cc: PSARC-ext@sun.com Message-id: <46717270.5040907@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200706081814.l58IEfnr011695@borg.SFBay.Sun.COM> User-Agent: Thunderbird 2.0.0.0 (X11/20070508) Status: RO Content-Length: 12204 Please note that dig(1M) is provided in SUNWbind from the Freeware consolidation with an interface stability of "External". Is it OK to rely on that? Does a contract need to be put in place? Regards, Stacey Wyllys Ingersoll wrote: > Template Version: @(#)sac_nextcase 1.61 05/24/07 SMI > This information is Copyright 2007 Sun Microsystems > 1. Introduction > 1.1. Project/Component Working Name: > kdcmgr utility > 1.2. Name of Document Author/Supplier: > Author: Shawn Emery > 1.3 Date of This Document: > 08 June, 2007 > 4. Technical Description > > ABSTRACT > -------- > > Some customers find the manual way of configuring Key Distribution Center > (KDC) servers tedious and is prone to error for them. This represents > dissatisfaction and increase in support costs to Sun. But more importantly, > administrators have come to expect simple interfaces for configuring servers. > > This project will provide a CLI to administrators for configuring > Kerberos Key Distribution Center (KDC) servers. The CLI will supply > options for configuring a master KDC and slave KDC. > > PROPOSAL > -------- > > This will be implemented in a scripting language (ksh) that will > make calls to Kerberos utilities to configure the master and slave > KDC servers. These Kerberos and system utilities include: > > kdb5_util(1M) > kadmin(1M) > kadmin.local(1M) > svcadm(1M) > dig(1M) > ping(1M) > > An alternative would be to make a GUI for configuring the KDC servers > using Java. However, this would require more resources as it > would take longer to implement. Most customers could still benefit > from an interactive script. > > The kdcmgr script will perform basic security checks and warn the > administrator if it detects a problem. > > Given the hundreds of possible KDC configurations it is impossible > to provide a simple interface to handle all of these. The assumption > is that this utility will provide configurations for a simple, but > common subset. > > DOCUMENTATION > ------------- > > kdcmgr(1M) is the new CLI for configuring KDC servers. It has an interactve > interface, but with options that can limit the interaction. > > A new man page will be created for kdcmgr(1M): > > System Administration Commands kdcmgr(1M) > > NAME > kdcmgr - set up a Kerberos Key Distribution Center (KDC) > > SYNOPSIS > /usr/sbin/kdcmgr [ -a admprincipal ] [ -e enctype ] [ -h ] > [ -p pwfile ] [ -r realm ] subcommand > > DESCRIPTION > The kdcmgr utility can be used to configure the following: > > o Configure a master Key Distribution Center (KDC) server. > > o Configure a slave KDC. Assumes that a master KDC has already been > configured. The default propagation method configured is incremental > propagation, see kpropd(1M). > > o Specify a list of slave KDCs to configure service principals and > create access control list for these slaves on the master KDC. > > If none of the options are provided then the user is prompted for > the required information. When sufficient options are provided the > user is still prompted for the password to generate the master key > and the password for the administrative principal, unless the -p > pwfile option was provided. > > The utility needs to be run as root on the server from which it is > invoked. Note that kdcmgr requires the user to enter sensitive > information, such as the password used to generate the database's > master key and the password for the administrative principal. Great > care must be taken to ensure that the connection to the server is > secured over the network, by using a protocol such as ssh. > > Great care must also be made when selecting the administrative and > master key passwords. They should be based off of non-dictionary > words and a long string of characters consisting of all of the > following character classes: > > Special characters (e.g. !@#$%^&*) > Numerals (0-9) > Upper case letters > Lower case letters > > OPTIONS > -a admprincipal > > When creating a master KDC, the -a argument specifies the > administrative principal, admprincipal, that will be created. > > When creating a slave KDC, admprincipal is used to authenticate > as the administrative principal. > > If -a is not specified then the suggested default adminstrative > principal name would be the output of logname(1) concatenated with > "/admin". > > -e enctype > > Specifies the encryption type to be used when creating the key for > the master key, which is used to encrypt all principal keys in the > database. The set of valid encryption types used here are described > in krb5.conf(4) under the permitted_enctypes option. > Note that the encryption type specified here must be supported on > all KDCs or else they will not be able to decrypt any of the > principal keys. Solaris 9 or earlier releases only support the > des-cbc-crc encryption type for the master key. Therefore if any > of the master or slave KDCs are of these older releases then > "-e des-cbc-crc" would need to be specified on all KDCs configured > with kdcmgr. > > The default encryption type is aes128-cts-hmac-sha1-96. > > -h > > Prints out the usage information for the kdcmgr utility. > > -p pwfile > > Provides the location of the password file that contains the password > used to create the administrative principal and/or master key. > > WARNING: This option should be used with great care to make sure > that this pwfile is accessible only by the root user and on a > local file system. Once the KDC has been configured removal of > the file should be performed. > > -r realm > > Set the default realm for this server. > > If the -r option is not specified then kdcmgr will attempt to > obtain the machine's local domain name by canonicalizing the > machine's host name through DNS and using the return value to > determine the domain name of the local machine. If successful > then the domain name will be upper cased and suggested as the > default realm name. > > SUBCOMMANDS > The following subcommands are supported: > > create [ master ] > create [ -m masterkdc ] slave > > Will create a KDC. If no option is specified an attempt to create > a master KDC will be made. > > create [ master ] > > Create a master KDC. Upon successful configuration the > krb5kdc(1M) and kadmind(1M) are enabled on the machine > > create [ -m masterkdc ] slave > > Configures a slave KDC. After configuration the krb5kdc(1M) > and kpropd(1M) services are enabled on the machine. > > masterkdc specifies the master KDC to authenticate and perform > administrative tasks with. If -m is not provided the user > will be prompted for a master KDC host name to use. > > Note that kdcmgr will need to be executed separately on each > of the slaves using kdcmgr's "create slave" subcommand. > > destroy > > Remove all Kerberos configuration and database files associated > with the KDC server. A confirmation is required before these > files are deleted. > > status > > Determines the role of the KDC, master or slave, and outputs > this and the state of the associated processes, such as: > > krb5kdc(1M) > kadmind(1M) > kpropd(1M) > > The subcommand will also display information on incremental > propagation if the configuration has this enabled, and any > issues with any dependent files. > > EXAMPLES > Example 1: Setting up a master KDC > > The following command will configure a master KDC with the > administrative principal user1/admin and with the EXAMPLE.COM > realm name: > > $ kdcmgr -a user1/admin -r EXAMPLE.COM create > > Note that a password will be required to assign to the user1/admin > principal that is created. The password for the master key will also > need to be provided. > > Example 2: Setting up a slave KDC > > The following command will configure a slave KDC, authenticate with the > administrative principal user1/admin, specifies kdc1 as the master, and > use the EXAMPLE.COM realm name: > > $ kdcmgr -a user1/admin -r EXAMPLE.COM create -m kdc1 slave > > Note that the correct password for user1/admin will need to be entered > and that the master KDC would have already been created before this. > The correct password for the master key will also be required. > > FILES > /etc/krb5/krb5.conf > Main Kerberos configuration file. > > /etc/krb5/kdc.conf > KDC configuration, used by both master and slave servers. > > /etc/krb5/krb5.keytab > Default location of the local host's service keys. > > /etc/krb5/kadm5.acl > Kerberos administrative access control list (ACL). > > /etc/krb5/kadm5.keytab > Service keys specific to kadmind(1M). > > /var/krb5/principal > Kerberos principal database. > > /var/krb5/principal.kadm5 > Kerberos policy database. > > /etc/krb5/kpropd.acl > Used by slaves to indicate which server to receive updates from. > > ATTRIBUTES > See attributes(5) for descriptions of the following attributes: > > ____________________________________________________________ > | ATTRIBUTE TYPE | ATTRIBUTE VALUE | > |_____________________________|_____________________________| > | Availability | SUNWkdcu | > |_____________________________|_____________________________| > | Interface Stability | See below | > |_____________________________|_____________________________| > > The command line interface (CLI) is Uncommitted. The CLI output is Not > an Interface. > > SEE ALSO > krb5.conf(4), kdc.conf(4), krb5kdc(1M), kpropd(1M), kadmind(1M), > kdb5_util(1M), kadmin(1M), kadmin.local(1M), svcadm(1M), dig(1M), > ping(1M) > > INTERFACE STABILITY AND RELEASE BINDINGS > ---------------------------------------- > > Interface Stability Release Binding > > kdcmgr(1M) Committed micro/patch > > 6. Resources and Schedule: > 6.4. Product Approval Committee requested information: > 6.4.1. Consolidation C-team Name: ON > 6.5. ARC review type: FastTrack > > > 6. Resources and Schedule > 6.4. Steering Committee requested information > 6.4.1. Consolidation C-team Name: > ON > 6.5. ARC review type: FastTrack > -- Stacey Jonathan Marshall. Solaris Revenue Product Engineering, EMEA Sun Microsystems Limited. +44-(0)1252-426106 (x26106) --------------------------------------------------------------------- http://blogs.sun.com/ace --------------------------------------------------------------------- From sacadmin Thu Jun 14 13:51:25 2007 Received: from sfbaymail1sca.SFBay.Sun.COM (sfbaymail1sca.SFBay.Sun.COM [129.145.154.35]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5EKpPZ3001734 for ; Thu, 14 Jun 2007 13:51:25 -0700 (PDT) Received: from sca-es-mail-2.sun.com (sca-es-mail-2.Sun.COM [192.18.43.133]) by sfbaymail1sca.SFBay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5EKnqAR016345 for ; Thu, 14 Jun 2007 13:49:52 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id l5EKnl3k027825 for ; Thu, 14 Jun 2007 13:49:47 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JJN00J018A7H500@fe-sfbay-09.sun.com> (original mail from John.Plocher@Sun.COM) for psarc-record@sac.sfbay.sun.com; Thu, 14 Jun 2007 13:49:47 -0700 (PDT) Received: from [129.146.58.87] by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JJN00F0U8IW1J40@fe-sfbay-09.sun.com> for psarc-record@sac.sfbay.sun.com; Thu, 14 Jun 2007 13:49:44 -0700 (PDT) Date: Thu, 14 Jun 2007 13:49:32 -0700 From: John Plocher Subject: Re: [Fwd: Re: kdcmgr utility [PSARC/2007/335 FastTrack timeout 06/14/2007]] Sender: John.Plocher@Sun.COM To: psarc-record@sac.sfbay.sun.com Message-id: <4671A9DC.2070007@Sun.Com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT User-Agent: Thunderbird 1.5.0.12 (Macintosh/20070509) Status: RO Content-Length: 13177 -------- Original Message -------- Subject: Re: [Fwd: Re: kdcmgr utility [PSARC/2007/335 FastTrack timeout 06/14/2007]] Date: Thu, 14 Jun 2007 12:08:01 -0600 From: Shawn M Emery To: PSARC-ext@sun.com CC: Solaris Kerberos_V5 PD alias References: <46717645.2020405@sun.com> Wyllys Ingersoll wrote: > Another question about the kdcmgr proposal... > > > -------- Original Message -------- > Subject: Re: kdcmgr utility [PSARC/2007/335 FastTrack timeout 06/14/2007] > Date: Thu, 14 Jun 2007 17:53:04 +0100 > From: Stacey Marshall > To: Wyllys Ingersoll > CC: PSARC-ext@sun.com > References: <200706081814.l58IEfnr011695@borg.SFBay.Sun.COM> > > Please note that dig(1M) is provided in SUNWbind from the Freeware > consolidation with an interface stability of "External". Is it OK to > rely on that? Does a contract need to be put in place? > Thanks for catching this. The new classification is "Volatile", but yes, I could avoid having a contract by writing my own compiled utility that interfaces with libresolv(3LIB). On a completely different note. Do the reviewers find that the use of subcommands and options is in adherence to our CLI best practices? In particular the use of an option with a subcommand? For example: # kdcmgr create [ -m masterkdc ] slave Shawn. -- > Wyllys Ingersoll wrote: > >> Template Version: @(#)sac_nextcase 1.61 05/24/07 SMI >> This information is Copyright 2007 Sun Microsystems >> 1. Introduction >> 1.1. Project/Component Working Name: >> kdcmgr utility >> 1.2. Name of Document Author/Supplier: >> Author: Shawn Emery >> 1.3 Date of This Document: >> 08 June, 2007 >> 4. Technical Description >> >> ABSTRACT >> -------- >> >> Some customers find the manual way of configuring Key Distribution Center >> (KDC) servers tedious and is prone to error for them. This represents >> dissatisfaction and increase in support costs to Sun. But more importantly, >> administrators have come to expect simple interfaces for configuring servers. >> >> This project will provide a CLI to administrators for configuring >> Kerberos Key Distribution Center (KDC) servers. The CLI will supply >> options for configuring a master KDC and slave KDC. >> >> PROPOSAL >> -------- >> >> This will be implemented in a scripting language (ksh) that will >> make calls to Kerberos utilities to configure the master and slave >> KDC servers. These Kerberos and system utilities include: >> >> kdb5_util(1M) >> kadmin(1M) >> kadmin.local(1M) >> svcadm(1M) >> dig(1M) >> ping(1M) >> >> An alternative would be to make a GUI for configuring the KDC servers >> using Java. However, this would require more resources as it >> would take longer to implement. Most customers could still benefit >> from an interactive script. >> >> The kdcmgr script will perform basic security checks and warn the >> administrator if it detects a problem. >> >> Given the hundreds of possible KDC configurations it is impossible >> to provide a simple interface to handle all of these. The assumption >> is that this utility will provide configurations for a simple, but >> common subset. >> >> DOCUMENTATION >> ------------- >> >> kdcmgr(1M) is the new CLI for configuring KDC servers. It has an interactve >> interface, but with options that can limit the interaction. >> >> A new man page will be created for kdcmgr(1M): >> >> System Administration Commands kdcmgr(1M) >> >> NAME >> kdcmgr - set up a Kerberos Key Distribution Center (KDC) >> >> SYNOPSIS >> /usr/sbin/kdcmgr [ -a admprincipal ] [ -e enctype ] [ -h ] >> [ -p pwfile ] [ -r realm ] subcommand >> >> DESCRIPTION >> The kdcmgr utility can be used to configure the following: >> >> o Configure a master Key Distribution Center (KDC) server. >> >> o Configure a slave KDC. Assumes that a master KDC has already been >> configured. The default propagation method configured is incremental >> propagation, see kpropd(1M). >> >> o Specify a list of slave KDCs to configure service principals and >> create access control list for these slaves on the master KDC. >> >> If none of the options are provided then the user is prompted for >> the required information. When sufficient options are provided the >> user is still prompted for the password to generate the master key >> and the password for the administrative principal, unless the -p >> pwfile option was provided. >> >> The utility needs to be run as root on the server from which it is >> invoked. Note that kdcmgr requires the user to enter sensitive >> information, such as the password used to generate the database's >> master key and the password for the administrative principal. Great >> care must be taken to ensure that the connection to the server is >> secured over the network, by using a protocol such as ssh. >> >> Great care must also be made when selecting the administrative and >> master key passwords. They should be based off of non-dictionary >> words and a long string of characters consisting of all of the >> following character classes: >> >> Special characters (e.g. !@#$%^&*) >> Numerals (0-9) >> Upper case letters >> Lower case letters >> >> OPTIONS >> -a admprincipal >> >> When creating a master KDC, the -a argument specifies the >> administrative principal, admprincipal, that will be created. >> >> When creating a slave KDC, admprincipal is used to authenticate >> as the administrative principal. >> >> If -a is not specified then the suggested default adminstrative >> principal name would be the output of logname(1) concatenated with >> "/admin". >> >> -e enctype >> >> Specifies the encryption type to be used when creating the key for >> the master key, which is used to encrypt all principal keys in the >> database. The set of valid encryption types used here are described >> in krb5.conf(4) under the permitted_enctypes option. >> Note that the encryption type specified here must be supported on >> all KDCs or else they will not be able to decrypt any of the >> principal keys. Solaris 9 or earlier releases only support the >> des-cbc-crc encryption type for the master key. Therefore if any >> of the master or slave KDCs are of these older releases then >> "-e des-cbc-crc" would need to be specified on all KDCs configured >> with kdcmgr. >> >> The default encryption type is aes128-cts-hmac-sha1-96. >> >> -h >> >> Prints out the usage information for the kdcmgr utility. >> >> -p pwfile >> >> Provides the location of the password file that contains the password >> used to create the administrative principal and/or master key. >> >> WARNING: This option should be used with great care to make sure >> that this pwfile is accessible only by the root user and on a >> local file system. Once the KDC has been configured removal of >> the file should be performed. >> >> -r realm >> >> Set the default realm for this server. >> >> If the -r option is not specified then kdcmgr will attempt to >> obtain the machine's local domain name by canonicalizing the >> machine's host name through DNS and using the return value to >> determine the domain name of the local machine. If successful >> then the domain name will be upper cased and suggested as the >> default realm name. >> >> SUBCOMMANDS >> The following subcommands are supported: >> >> create [ master ] >> create [ -m masterkdc ] slave >> >> Will create a KDC. If no option is specified an attempt to create >> a master KDC will be made. >> >> create [ master ] >> >> Create a master KDC. Upon successful configuration the >> krb5kdc(1M) and kadmind(1M) are enabled on the machine >> >> create [ -m masterkdc ] slave >> >> Configures a slave KDC. After configuration the krb5kdc(1M) >> and kpropd(1M) services are enabled on the machine. >> >> masterkdc specifies the master KDC to authenticate and perform >> administrative tasks with. If -m is not provided the user >> will be prompted for a master KDC host name to use. >> >> Note that kdcmgr will need to be executed separately on each >> of the slaves using kdcmgr's "create slave" subcommand. >> >> destroy >> >> Remove all Kerberos configuration and database files associated >> with the KDC server. A confirmation is required before these >> files are deleted. >> >> status >> >> Determines the role of the KDC, master or slave, and outputs >> this and the state of the associated processes, such as: >> >> krb5kdc(1M) >> kadmind(1M) >> kpropd(1M) >> >> The subcommand will also display information on incremental >> propagation if the configuration has this enabled, and any >> issues with any dependent files. >> >> EXAMPLES >> Example 1: Setting up a master KDC >> >> The following command will configure a master KDC with the >> administrative principal user1/admin and with the EXAMPLE.COM >> realm name: >> >> $ kdcmgr -a user1/admin -r EXAMPLE.COM create >> >> Note that a password will be required to assign to the user1/admin >> principal that is created. The password for the master key will also >> need to be provided. >> >> Example 2: Setting up a slave KDC >> >> The following command will configure a slave KDC, authenticate with the >> administrative principal user1/admin, specifies kdc1 as the master, and >> use the EXAMPLE.COM realm name: >> >> $ kdcmgr -a user1/admin -r EXAMPLE.COM create -m kdc1 slave >> >> Note that the correct password for user1/admin will need to be entered >> and that the master KDC would have already been created before this. >> The correct password for the master key will also be required. >> >> FILES >> /etc/krb5/krb5.conf >> Main Kerberos configuration file. >> >> /etc/krb5/kdc.conf >> KDC configuration, used by both master and slave servers. >> >> /etc/krb5/krb5.keytab >> Default location of the local host's service keys. >> >> /etc/krb5/kadm5.acl >> Kerberos administrative access control list (ACL). >> >> /etc/krb5/kadm5.keytab >> Service keys specific to kadmind(1M). >> >> /var/krb5/principal >> Kerberos principal database. >> >> /var/krb5/principal.kadm5 >> Kerberos policy database. >> >> /etc/krb5/kpropd.acl >> Used by slaves to indicate which server to receive updates from. >> >> ATTRIBUTES >> See attributes(5) for descriptions of the following attributes: >> >> ____________________________________________________________ >> | ATTRIBUTE TYPE | ATTRIBUTE VALUE | >> |_____________________________|_____________________________| >> | Availability | SUNWkdcu | >> |_____________________________|_____________________________| >> | Interface Stability | See below | >> |_____________________________|_____________________________| >> >> The command line interface (CLI) is Uncommitted. The CLI output is Not >> an Interface. >> >> SEE ALSO >> krb5.conf(4), kdc.conf(4), krb5kdc(1M), kpropd(1M), kadmind(1M), >> kdb5_util(1M), kadmin(1M), kadmin.local(1M), svcadm(1M), dig(1M), >> ping(1M) >> >> INTERFACE STABILITY AND RELEASE BINDINGS >> ---------------------------------------- >> >> Interface Stability Release Binding >> >> kdcmgr(1M) Committed micro/patch >> >> 6. Resources and Schedule: >> 6.4. Product Approval Committee requested information: >> 6.4.1. Consolidation C-team Name: ON >> 6.5. ARC review type: FastTrack >> >> >> 6. Resources and Schedule >> 6.4. Steering Committee requested information >> 6.4.1. Consolidation C-team Name: >> ON >> 6.5. ARC review type: FastTrack >> >> > > > -- Shawn. _______________________________________________ opensolaris-arc mailing list opensolaris-arc@opensolaris.org From Shawn.Emery@Sun.COM Tue Jun 19 00:25:24 2007 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5J7POmD003325 for ; Tue, 19 Jun 2007 00:25:24 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5J7NkaS018109; Tue, 19 Jun 2007 00:23:47 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJV00009GJMWC00@brm-avmta-1.central.sun.com>; Tue, 19 Jun 2007 01:23:46 -0600 (MDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJV0089UGJM59B0@brm-avmta-1.central.sun.com>; Tue, 19 Jun 2007 01:23:46 -0600 (MDT) Received: from fe-amer-03.sun.com ([192.18.108.177]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id l5J7NjiT003519; Tue, 19 Jun 2007 07:23:45 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0JJV00N01G0P1Q00@mail-amer.sun.com> (original mail from Shawn.Emery@Sun.COM); Tue, 19 Jun 2007 01:23:45 -0600 (MDT) Received: from [129.150.48.17] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0JJV00IQ6GJKAVK6@mail-amer.sun.com>; Tue, 19 Jun 2007 01:23:45 -0600 (MDT) Date: Tue, 19 Jun 2007 01:22:43 -0600 From: Shawn M Emery Subject: Re: [Fwd: Re: kdcmgr utility [PSARC/2007/335 FastTrack timeout 06/14/2007]] In-reply-to: <46718401.6070601@sun.com> Sender: Shawn.Emery@Sun.COM Cc: PSARC-ext@Sun.COM, Solaris Kerberos_V5 PD alias Message-id: <46778443.9080102@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <46717645.2020405@sun.com> <46718401.6070601@sun.com> User-Agent: Thunderbird 2.0.0.0 (X11/20070419) Status: RO Content-Length: 16163 Here is the summary of changes to the kdcmgr(1M) one-pager, followed by diffs: 1. Added a reference to exec_attr(4) to indicate that kdcmgr(1M) will be included in the Kerberos Server Management profile. 2. Removed references of the "root" user and replaced with "authorized user" text. 3. Replaced reference to dig(1M) and replaced with libresolv(3LIB), as a new C utility will be created to avoid a contract with a "Volatile" interface. ks.op - one-pager diffs: @@ -31,12 +31,13 @@ kdb5_util(1M) kadmin(1M) kadmin.local(1M) svcadm(1M) - dig(1M) + libresolv(3LIB) ping(1M) + exec_attr(4) An alternative would be to make a GUI for configuring the KDC servers using Java. However, this would require more resources as it would take longer to implement. Most customers could still benefit from an interactive script. @@ -82,15 +83,15 @@ the required information. When sufficient options are provided the user is still prompted for the password to generate the master key and the password for the administrative principal, unless the -p pwfile option was provided. - The utility needs to be run as root on the server from which it is - invoked. Note that kdcmgr requires the user to enter sensitive - information, such as the password used to generate the database's - master key and the password for the administrative principal. Great - care must be taken to ensure that the connection to the server is + The utility needs to be run as an authorized user on the server from + which it is invoked. Note that kdcmgr requires the user to enter + sensitive information, such as the password used to generate the + database's master key and the password for the administrative principal. + Great care must be taken to ensure that the connection to the server is secured over the network, by using a protocol such as ssh. Great care must also be made when selecting the administrative and master key passwords. They should be based off of non-dictionary words and a long string of characters consisting of all of the @@ -139,11 +140,11 @@ Provides the location of the password file that contains the password used to create the administrative principal and/or master key. WARNING: This option should be used with great care to make sure - that this pwfile is accessible only by the root user and on a + that this pwfile is accessible only to authorized users and on a local file system. Once the KDC has been configured removal of the file should be performed. -r realm Shawn. -- Shawn M Emery wrote: > Wyllys Ingersoll wrote: >> Another question about the kdcmgr proposal... >> >> >> -------- Original Message -------- >> Subject: Re: kdcmgr utility [PSARC/2007/335 FastTrack timeout >> 06/14/2007] >> Date: Thu, 14 Jun 2007 17:53:04 +0100 >> From: Stacey Marshall >> To: Wyllys Ingersoll >> CC: PSARC-ext@sun.com >> References: <200706081814.l58IEfnr011695@borg.SFBay.Sun.COM> >> >> Please note that dig(1M) is provided in SUNWbind from the Freeware >> consolidation with an interface stability of "External". Is it OK to >> rely on that? Does a contract need to be put in place? >> > Thanks for catching this. > > The new classification is "Volatile", but yes, I could avoid having a > contract by writing my own compiled utility that interfaces with > libresolv(3LIB). > > On a completely different note. Do the reviewers find that the use of > subcommands and options is in adherence to our CLI best practices? In > particular the use of an option with a subcommand? For example: > > # kdcmgr create [ -m masterkdc ] slave > > Shawn. > -- >> Wyllys Ingersoll wrote: >> >>> Template Version: @(#)sac_nextcase 1.61 05/24/07 SMI >>> This information is Copyright 2007 Sun Microsystems >>> 1. Introduction >>> 1.1. Project/Component Working Name: >>> kdcmgr utility >>> 1.2. Name of Document Author/Supplier: >>> Author: Shawn Emery >>> 1.3 Date of This Document: >>> 08 June, 2007 >>> 4. Technical Description >>> >>> ABSTRACT >>> -------- >>> >>> Some customers find the manual way of configuring Key Distribution >>> Center >>> (KDC) servers tedious and is prone to error for them. This represents >>> dissatisfaction and increase in support costs to Sun. But more >>> importantly, >>> administrators have come to expect simple interfaces for configuring >>> servers. >>> >>> This project will provide a CLI to administrators for configuring >>> Kerberos Key Distribution Center (KDC) servers. The CLI will supply >>> options for configuring a master KDC and slave KDC. >>> >>> PROPOSAL >>> -------- >>> >>> This will be implemented in a scripting language (ksh) that will >>> make calls to Kerberos utilities to configure the master and slave >>> KDC servers. These Kerberos and system utilities include: >>> >>> kdb5_util(1M) >>> kadmin(1M) >>> kadmin.local(1M) >>> svcadm(1M) >>> dig(1M) >>> ping(1M) >>> >>> An alternative would be to make a GUI for configuring the KDC servers >>> using Java. However, this would require more resources as it >>> would take longer to implement. Most customers could still benefit >>> from an interactive script. >>> >>> The kdcmgr script will perform basic security checks and warn the >>> administrator if it detects a problem. >>> >>> Given the hundreds of possible KDC configurations it is impossible >>> to provide a simple interface to handle all of these. The assumption >>> is that this utility will provide configurations for a simple, but >>> common subset. >>> >>> DOCUMENTATION >>> ------------- >>> >>> kdcmgr(1M) is the new CLI for configuring KDC servers. It has an >>> interactve >>> interface, but with options that can limit the interaction. >>> >>> A new man page will be created for kdcmgr(1M): >>> >>> System Administration Commands kdcmgr(1M) >>> >>> NAME >>> kdcmgr - set up a Kerberos Key Distribution Center (KDC) >>> >>> SYNOPSIS >>> /usr/sbin/kdcmgr [ -a admprincipal ] [ -e enctype ] [ -h ] >>> [ -p pwfile ] [ -r realm ] subcommand >>> >>> DESCRIPTION >>> The kdcmgr utility can be used to configure the following: >>> >>> o Configure a master Key Distribution Center (KDC) server. >>> >>> o Configure a slave KDC. Assumes that a master KDC has >>> already been >>> configured. The default propagation method configured is >>> incremental >>> propagation, see kpropd(1M). >>> >>> o Specify a list of slave KDCs to configure service >>> principals and >>> create access control list for these slaves on the master KDC. >>> >>> If none of the options are provided then the user is >>> prompted for >>> the required information. When sufficient options are >>> provided the >>> user is still prompted for the password to generate the >>> master key >>> and the password for the administrative principal, unless >>> the -p >>> pwfile option was provided. >>> >>> The utility needs to be run as root on the server from which >>> it is >>> invoked. Note that kdcmgr requires the user to enter sensitive >>> information, such as the password used to generate the >>> database's >>> master key and the password for the administrative >>> principal. Great >>> care must be taken to ensure that the connection to the >>> server is >>> secured over the network, by using a protocol such as ssh. >>> >>> Great care must also be made when selecting the >>> administrative and >>> master key passwords. They should be based off of >>> non-dictionary >>> words and a long string of characters consisting of all of the >>> following character classes: >>> >>> Special characters (e.g. !@#$%^&*) >>> Numerals (0-9) >>> Upper case letters >>> Lower case letters >>> >>> OPTIONS >>> -a admprincipal >>> >>> When creating a master KDC, the -a argument specifies the >>> administrative principal, admprincipal, that will be >>> created. >>> >>> When creating a slave KDC, admprincipal is used to >>> authenticate >>> as the administrative principal. >>> >>> If -a is not specified then the suggested default >>> adminstrative >>> principal name would be the output of logname(1) >>> concatenated with >>> "/admin". >>> >>> -e enctype >>> >>> Specifies the encryption type to be used when creating >>> the key for >>> the master key, which is used to encrypt all principal >>> keys in the >>> database. The set of valid encryption types used here >>> are described >>> in krb5.conf(4) under the permitted_enctypes option. >>> Note that the encryption type specified here must be >>> supported on >>> all KDCs or else they will not be able to decrypt any of the >>> principal keys. Solaris 9 or earlier releases only >>> support the >>> des-cbc-crc encryption type for the master key. >>> Therefore if any >>> of the master or slave KDCs are of these older releases then >>> "-e des-cbc-crc" would need to be specified on all KDCs >>> configured >>> with kdcmgr. >>> >>> The default encryption type is aes128-cts-hmac-sha1-96. >>> >>> -h >>> >>> Prints out the usage information for the kdcmgr utility. >>> >>> -p pwfile >>> >>> Provides the location of the password file that contains >>> the password >>> used to create the administrative principal and/or master >>> key. >>> >>> WARNING: This option should be used with great care to >>> make sure >>> that this pwfile is accessible only by the root user and >>> on a >>> local file system. Once the KDC has been configured >>> removal of >>> the file should be performed. >>> >>> -r realm >>> >>> Set the default realm for this server. >>> >>> If the -r option is not specified then kdcmgr will >>> attempt to >>> obtain the machine's local domain name by canonicalizing the >>> machine's host name through DNS and using the return >>> value to >>> determine the domain name of the local machine. If >>> successful >>> then the domain name will be upper cased and suggested as >>> the >>> default realm name. >>> >>> SUBCOMMANDS >>> The following subcommands are supported: >>> >>> create [ master ] >>> create [ -m masterkdc ] slave >>> >>> Will create a KDC. If no option is specified an attempt >>> to create a master KDC will be made. >>> >>> create [ master ] >>> >>> Create a master KDC. Upon successful configuration the >>> krb5kdc(1M) and kadmind(1M) are enabled on the machine >>> >>> create [ -m masterkdc ] slave >>> >>> Configures a slave KDC. After configuration the >>> krb5kdc(1M) >>> and kpropd(1M) services are enabled on the machine. >>> >>> masterkdc specifies the master KDC to authenticate >>> and perform >>> administrative tasks with. If -m is not provided >>> the user >>> will be prompted for a master KDC host name to use. >>> >>> Note that kdcmgr will need to be executed separately >>> on each >>> of the slaves using kdcmgr's "create slave" subcommand. >>> >>> destroy >>> >>> Remove all Kerberos configuration and database files >>> associated >>> with the KDC server. A confirmation is required before >>> these >>> files are deleted. >>> >>> status >>> >>> Determines the role of the KDC, master or slave, and >>> outputs >>> this and the state of the associated processes, such as: >>> >>> krb5kdc(1M) >>> kadmind(1M) >>> kpropd(1M) >>> >>> The subcommand will also display information on incremental >>> propagation if the configuration has this enabled, and any >>> issues with any dependent files. >>> >>> EXAMPLES >>> Example 1: Setting up a master KDC >>> >>> The following command will configure a master KDC with the >>> administrative principal user1/admin and with the EXAMPLE.COM >>> realm name: >>> >>> $ kdcmgr -a user1/admin -r EXAMPLE.COM create >>> >>> Note that a password will be required to assign to the >>> user1/admin >>> principal that is created. The password for the master key >>> will also >>> need to be provided. >>> >>> Example 2: Setting up a slave KDC >>> >>> The following command will configure a slave KDC, >>> authenticate with the >>> administrative principal user1/admin, specifies kdc1 as the >>> master, and >>> use the EXAMPLE.COM realm name: >>> >>> $ kdcmgr -a user1/admin -r EXAMPLE.COM create -m kdc1 slave >>> >>> Note that the correct password for user1/admin will need to >>> be entered >>> and that the master KDC would have already been created >>> before this. >>> The correct password for the master key will also be required. >>> >>> FILES >>> /etc/krb5/krb5.conf >>> Main Kerberos configuration file. >>> >>> /etc/krb5/kdc.conf >>> KDC configuration, used by both master and slave >>> servers. >>> >>> /etc/krb5/krb5.keytab >>> Default location of the local host's service keys. >>> >>> /etc/krb5/kadm5.acl >>> Kerberos administrative access control list (ACL). >>> >>> /etc/krb5/kadm5.keytab >>> Service keys specific to kadmind(1M). >>> >>> /var/krb5/principal >>> Kerberos principal database. >>> /var/krb5/principal.kadm5 >>> Kerberos policy database. >>> >>> /etc/krb5/kpropd.acl >>> Used by slaves to indicate which server to receive >>> updates from. >>> >>> ATTRIBUTES >>> See attributes(5) for descriptions of the following attributes: >>> >>> ____________________________________________________________ >>> | ATTRIBUTE TYPE | ATTRIBUTE VALUE | >>> |_____________________________|_____________________________| >>> | Availability | SUNWkdcu | >>> |_____________________________|_____________________________| >>> | Interface Stability | See below | >>> |_____________________________|_____________________________| >>> >>> The command line interface (CLI) is Uncommitted. The CLI output >>> is Not >>> an Interface. >>> >>> SEE ALSO >>> krb5.conf(4), kdc.conf(4), krb5kdc(1M), kpropd(1M), >>> kadmind(1M), >>> kdb5_util(1M), kadmin(1M), kadmin.local(1M), svcadm(1M), >>> dig(1M), >>> ping(1M) >>> >>> INTERFACE STABILITY AND RELEASE BINDINGS >>> ---------------------------------------- >>> >>> Interface Stability Release Binding >>> >>> kdcmgr(1M) Committed micro/patch >>> >>> 6. Resources and Schedule: >>> 6.4. Product Approval Committee requested information: >>> 6.4.1. Consolidation C-team Name: ON >>> 6.5. ARC review type: FastTrack >>> >>> >>> 6. Resources and Schedule >>> 6.4. Steering Committee requested information >>> 6.4.1. Consolidation C-team Name: >>> ON >>> 6.5. ARC review type: FastTrack >>> >> >> >> > > -- Shawn. From gww@eng.sun.com Tue Jun 19 11:41:55 2007 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5JIfsgm017987 for ; Tue, 19 Jun 2007 11:41:55 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5JIdj9B011939 for <@sunmail3mpk.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 19 Jun 2007 12:39:45 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJW00B03BV55K00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 19 Jun 2007 11:40:17 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJW00B1ABV44O00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 19 Jun 2007 11:40:17 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5JIeEJo020720; Tue, 19 Jun 2007 11:40:14 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id l5JIgxEG021888; Tue, 19 Jun 2007 11:42:59 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id l5JIgxXn021887; Tue, 19 Jun 2007 11:42:59 -0700 (PDT) Date: Tue, 19 Jun 2007 11:42:59 -0700 (PDT) From: Gary Winiger Subject: Re: [Fwd: Re: kdcmgr utility [PSARC/2007/335 FastTrack timeout 06/14/2007]] To: Shawn.Emery@sun.com Cc: PSARC-ext@sun.com, stacey.marshall@sun.com, wyllys.ingersoll@sun.com Message-id: <200706191842.l5JIgxXn021887@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 333 > On a completely different note. Do the reviewers find that the use of > subcommands and options is in adherence to our CLI best practices? In > particular the use of an option with a subcommand? For example: > > # kdcmgr create [ -m masterkdc ] slave I believe the subcommands should come first. See zfs and svcadm. Gary.. From Nicolas.Williams@Sun.COM Tue Jun 19 12:22:03 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5JJM2DE018926 for ; Tue, 19 Jun 2007 12:22:03 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5JJKFNL006423; Tue, 19 Jun 2007 20:20:21 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJW00C01DPVX300@nwk-avmta-1.sfbay.Sun.COM>; Tue, 19 Jun 2007 12:20:19 -0700 (PDT) Received: from localhost.Central.Sun.COM ([129.153.128.213]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJW0041WDPUTR90@nwk-avmta-1.sfbay.Sun.COM>; Tue, 19 Jun 2007 12:20:18 -0700 (PDT) Received: from localhost.Central.Sun.COM (localhost [127.0.0.1]) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id l5JJJLDK025524; Tue, 19 Jun 2007 14:19:21 -0500 (CDT) Received: (from nw141292@localhost) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id l5JJJLr5025523; Tue, 19 Jun 2007 14:19:21 -0500 (CDT) Date: Tue, 19 Jun 2007 14:19:21 -0500 From: Nicolas Williams Subject: Re: [Fwd: Re: kdcmgr utility [PSARC/2007/335 FastTrack timeout 06/14/2007]] In-reply-to: <46718401.6070601@sun.com> To: Shawn M Emery Cc: PSARC-ext@Sun.COM, Solaris Kerberos_V5 PD alias Mail-followup-to: Shawn M Emery , PSARC-ext@sun.com, Solaris Kerberos_V5 PD alias Message-id: <20070619191920.GK25240@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.2.0.264296 References: <46717645.2020405@sun.com> <46718401.6070601@sun.com> X-Authentication-warning: localhost.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 788 On Thu, Jun 14, 2007 at 12:08:01PM -0600, Shawn M Emery wrote: > >Please note that dig(1M) is provided in SUNWbind from the Freeware > >consolidation with an interface stability of "External". Is it OK to > >rely on that? Does a contract need to be put in place? > > The new classification is "Volatile", but yes, I could avoid having a > contract by writing my own compiled utility that interfaces with > libresolv(3LIB). Er, we really, really need a CLI for DNS that can be used for scripting. The current state of affairs with nslookup and dig is quite unsatisfying. (What do our customers do? I bet they treat dig as a Committed interface. Nothing else would do, IMO. Though, of course, some/most/all of the comments in dig's output should be not-an- interface.) Nico -- From sommerfeld@sun.com Tue Jun 19 12:51:08 2007 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5JJp8EL019192 for ; Tue, 19 Jun 2007 12:51:08 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5JJnUf4026909; Tue, 19 Jun 2007 12:49:31 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJW0040BF2IBG00@brm-avmta-1.central.sun.com>; Tue, 19 Jun 2007 13:49:30 -0600 (MDT) Received: from eastmail1bur.East.Sun.COM ([129.148.9.49]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJW00HKRF2HQPC0@brm-avmta-1.central.sun.com>; Tue, 19 Jun 2007 13:49:30 -0600 (MDT) Received: from thunk.east.sun.com (thunk.East.Sun.COM [129.148.174.66]) by eastmail1bur.East.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5JJnSE4005388; Tue, 19 Jun 2007 15:49:28 -0400 (EDT) Received: from [IPv6:::1] (localhost [IPv6:::1]) by thunk.east.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5JJnSgk005276; Tue, 19 Jun 2007 15:49:28 -0400 (EDT) Date: Tue, 19 Jun 2007 15:49:27 -0400 From: Bill Sommerfeld Subject: Re: [Fwd: Re: kdcmgr utility [PSARC/2007/335 FastTrack timeout 06/14/2007]] In-reply-to: <20070619191920.GK25240@Sun.COM> To: Nicolas Williams Cc: Shawn M Emery , PSARC-ext@sun.com, Solaris Kerberos_V5 PD alias Message-id: <1182282567.3708.46.camel@thunk> MIME-version: 1.0 X-Mailer: Evolution 2.8.1.1 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <46717645.2020405@sun.com> <46718401.6070601@sun.com> <20070619191920.GK25240@Sun.COM> Status: RO Content-Length: 478 On Tue, 2007-06-19 at 14:19 -0500, Nicolas Williams wrote: > (What do our customers do? I bet they treat dig as a Committed > interface. Nothing else would do, IMO. Though, of course, > some/most/all of the comments in dig's output should be not-an- > interface.) Indeed. I use dig a lot and haven't noticed any incompatible change to its command syntax in years. Our philosophy is closer to "past performance is no guarantee of future results", though.. - Bill