From gww@eng.sun.com Tue Jun 19 12:47:11 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5JJl9r9019151 for ; Tue, 19 Jun 2007 12:47:10 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5JJjP3T028169; Wed, 20 Jun 2007 03:45:31 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJW00E03EVT1U00@nwk-avmta-2.sfbay.sun.com>; Tue, 19 Jun 2007 12:45:29 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJW00B6AEVS4L40@nwk-avmta-2.sfbay.sun.com>; Tue, 19 Jun 2007 12:45:28 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5JJjSmS027659; Tue, 19 Jun 2007 12:45:28 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id l5JJmDGh022212; Tue, 19 Jun 2007 12:48:13 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id l5JJmD16022211; Tue, 19 Jun 2007 12:48:13 -0700 (PDT) Date: Tue, 19 Jun 2007 12:48:13 -0700 (PDT) From: Gary Winiger Subject: Re: krb5_ldap_util command for Solaris Kerberos [PSARC/2007/368 FastTrack timeout 06/26/,2007] To: PSARC-ext@sun.com, wyllys.ingersoll@sun.com Cc: krb5-core@sun.com, john.plocher@sun.com Message-id: <200706191948.l5JJmD16022211@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-Sun-Charset: US-ASCII X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 30253 sac mail seems broken. The case log for this case is empty. replying here to populate the case log. Wyllys writes: > I am sponsoring the following fast-track for Will Fiveash. > > * The release binding is patch/micro. > * The interface stability is committed. > * The timer is set for 1 week (6/27/2007) > > - Wyllys Ingersoll > > > > > Template Version: @(#)onepager.txt 1.29 04/11/15 SMI > > This information is > Copyright 2007 Sun Microsystems, Inc. > > 1. Introduction > 1.1. Project/Component Working Name: > > kdb5_ldap_util command for Solaris Kerberos > > 1.2. Name of Document Author/Supplier: > > Will Fiveash > > 1.3. Date of This Document: > 07/03/04 > > 1.4. Name of Major Document Customer(s)/Consumer(s): > 1.4.1. The PAC or CPT you expect to review your project: > > Solaris PAC > > 1.4.2. The ARC(s) you expect to review your project: > > PSARC > > 1.4.3. The Director/VP who is "Sponsoring" this project: > > Kathy Jenks > > 1.4.4. The name of your business unit: > > Software > > 1.5. Email Aliases: > 1.5.1. Responsible Manager: Anup.Sekhar@Sun.COM > 1.5.2. Responsible Engineer: William.Fiveash@sun.com > 1.5.3. Marketing Manager: Mark.Thacker@Sun.COM > 1.5.4. Interest List: kerberos-interest@sun.com > > 2. Project Summary > 2.1. Project Description: > > This fasttrack is about including a new utility, kdb5_ldap_util, > as part of an earlier fast track: > > PSARC 2006/277 LDAP Backend for Kerberos KDC > > This utility is used to manage certain LDAP objects and a > LDAP/SASL bind password file not managed by the current > kadmin/kadmin.local commands. These include the > krbRealmContainer object and the KrbPolicy and KrbPolicyAux > objects that contain ticket policy attributes. > > 2.2. Risks and Assumptions: > > - Risk: This is a new utility from MIT and may undergo changes > in its interface. > > 3. Business Summary > 3.1. Problem Area: > > When Novell contributed code to MIT to enable the KDC to access > Kerberos records via LDAP they provided a schema with a number > of classes some of which are not managed by any of the existing > utilities (kdb5_util, kadmin). These classes > (krbRealmContainer, krbPolicy/krbPolicyAux) contain optional > attributes that can be set via a new utility called > kdb5_ldap_util. Novell decided that modifying the existing > utilities like kdb5_util or kadmin was problematic because these > utilities are closely oriented towards the existing Kerberos > records thus they provided kdb5_ldap_util. In addition to > providing a administration interface for the mentioned classes > kdb5_ldap_util provides a interface to manage a hex encoded > password file used by the KDC for simple SASL binds to the > Directory Server. > > 3.2. Market/Requester: > > Citi Group, Shell, Clearstream, Cisco, Motorola, Sun ITOps > (from Mark Thacker) > > 3.3. Business Justification: > > Kerberos is an important part of the Solaris Single-Sign-On > strategy and is also used by MS Active Directory for security > and is thus required for Solaris AD interoperability. > Enterprise customers want tighter integration between Solaris > Kerberos databases and their existing DS setups as this will > simplify the database administration. This utility is needed to > provide more complete administration of the optional LDAP > classes that control KDC configuration. > > 3.4. Competitive Analysis: > > Our competition is IBM, HP, Microsoft, Apple and various Linux > distributions. By providing a LDAP backend plugin for the KDC, > Solaris Kerberos is taking a step towards integration with our > DS. The kdb5_ldap_utility provides additional administration > control over KDC configuration stored in LDAP objects. > > 3.5. Opportunity Window/Exposure: > > N/A > > 3.6. How will you know when you are done?: > > This project will be done when Solaris Kerberos has the ability > to access (read/write) KDB records via LDAP and local Berkely > db2 DB tested and documentation updated. In addition > kdb5_ldap_util function will be fully tested. > > 4. Technical Description: > 4.1. Details: > > This will be done by porting the MIT kdb5_ldap_util utility into > ON. > > 4.2. Bug/RFE Number(s): > > 6399903 Support for Kerberos Records in LDAP Directory > > 4.3. In Scope: > > Modifications of several Kerberos utilities and daemons to > support the LDAP plugin will be done as part of the port. This > includes the krb5kdc, kadmin, kadmind, kdb5_util and > kdb5_ldap_util. See section 4.5 Interfaces for more > information. > > 4.4. Out of Scope: > > Previously I had written that KDB Administration tools beyond > the currently provide kadmin and kdb5_util were out of scope. > Since then I have determined that the kdb5_ldap_util is needed > to manage the hex encoded password file used if the KDC is > configured to do a password based SASL bind to the DS. In > addition kdb5_ldap_util allows management of the object classes > described in section 3.1. > > 4.5. Interfaces: > > From the man page: > > SYNOPSIS > kdb5_ldap_util [-D user_dn [-w passwd]] [-H ldapuri] command > [command_options] > > DESCRIPTION > kdb5_ldap_util allows an administrator to manage realms, > Kerberos services and ticket policies. > > COMMAND-LINE OPTIONS > -D user_dn > Specifies the Distinguished name (DN) of the user who > has sufficient rights to perform the operation on the > LDAP server. > > -H ldapuri > Specifies the URI of the LDAP server. > > COMMANDS: > > create \ > [-subtrees subtree_dn_list] > [-sscope search_scope] > [-containerref container_reference_dn] > [-k mkeytype] > [-m|-P password|-sf stashfilename] > [-s] > [-r realm] > [-maxtktlife max_ticket_life] > [-maxrenewlife max_renewable_ticket_life] > [ticket_flags] > > Creates realm in directory. Options: > > -subtrees subtree_dn_list > Specifies the list of subtrees containing the > principals of a realm. The list contains the DNs > of the subtree objects separated by colon(:). > > -sscope search_scope > Specifies the scope for searching the principals > under the subtree. The possible values are 1 or > one (one level), 2 or sub (subtrees). > > -containerref container_reference_dn > Specifies the DN of the container object in which > the principals of a realm will be created. If the > container reference is not configured for a realm, > the principals will be created in the realm con- > tainer. > > -k mkeytype > > Specifies the key type of the master key in the > database; the default is that given in kdc.conf. > > -m Specifies that the master database password should > be read from the TTY rather than fetched from a > file on the disk. > > -P password > Specifies the master database password. This > option is not recommended. > > -sf stashfilename > Specifies the stash file of the master database > password. > > -s Specifies that the stash file is to be created. > > -maxtktlife max_ticket_life > Specifies maximum ticket life for principals in > this realm. > > -maxrenewlife max_renewable_ticket_life > Specifies maximum renewable life of tickets for > principals in this realm. > > ticket_flags > Specifies the ticket flags. If this option is not > specified, by default, none of the flags are set. > This means all the ticket options will be allowed > and no restriction will be set. > > The various flags are: > > {-|+}allow_postdated > -allow_postdated prohibits principals from obtain- > ing postdated tickets. (Sets the > KRB5_KDB_DISALLOW_POSTDATED flag.) > +allow_postdated clears this flag. > > {-|+}allow_forwardable > -allow_forwardable prohibits principals from > obtaining forwardable tickets. (Sets the > KRB5_KDB_DISALLOW_FORWARDABLE flag.) > +allow_forwardable clears this flag. > > {-|+}allow_renewable > -allow_renewable prohibits principals from obtain- > ing renewable tickets. (Sets the > KRB5_KDB_DISALLOW_RENEWABLE flag.) > +allow_renewable clears this flag. > > {-|+}allow_proxiable > > -allow_proxiable prohibits principals from obtain- > ing proxiable tickets. (Sets the > KRB5_KDB_DISALLOW_PROXIABLE flag.) > +allow_proxiable clears this flag. > > {-|+}allow_dup_skey > -allow_dup_skey Disables user-to-user authentica- > tion for principals by prohibiting principals from > obtaining a session key for another user. (Sets > the KRB5_KDB_DISALLOW_DUP_SKEY flag.) > +allow_dup_skey clears this flag. > > {-|+}requires_preauth > +requires_preauth requires principals to preau- > thenticate before being allowed to kinit. (Sets > the KRB5_KDB_REQUIRES_PRE_AUTH flag.) - > requires_preauth clears this flag. > > {-|+}requires_hwauth > +requires_hwauth requires principals to preauthen- > ticate using a hardware device before being > allowed to kinit. (Sets the > KRB5_KDB_REQUIRES_HW_AUTH flag.) -requires_hwauth > clears this flag. > > {-|+}allow_svr > -allow_svr prohibits the issuance of service tick- > ets for principals. (Sets the > KRB5_KDB_DISALLOW_SVR flag.) +allow_svr clears > this flag. > > {-|+}allow_tgs_req > -allow_tgs_req specifies that a Ticket-Granting > Service (TGS) request for a service ticket for > principals is not permitted. This option is use- > less for most things. +allow_tgs_req clears this > flag. The default is +allow_tgs_req. In effect, > -allow_tgs_req sets the > KRB5_KDB_DISALLOW_TGT_BASED flag on principals in > the database. > > {-|+}allow_tix > -allow_tix forbids the issuance of any tickets for > principals. +allow_tix clears this flag. The > default is +allow_tix. In effect, -allow_tix sets > the KRB5_KDB_DISALLOW_ALL_TIX flag on principals > in the database. > > {-|+}needchange > +needchange sets a flag in attributes field to > force a password change; -needchange clears it. > The default is -needchange. In effect, > +needchange sets the KRB5_KDB_REQUIRES_PWCHANGE > flag on principals in the database. > > {-|+}password_changing_service > +password_changing_service sets a flag in the > attributes field marking principal as a password > change service principal (useless for most > things). -password_changing_service clears the > flag. This flag intentionally has a long name. The > default is -password_changing_service. In effect, > +password_changing_service sets the > KRB5_KDB_PWCHANGE_SERVICE flag on principals in > the database. > > -r realm > Specifies the Kerberos realm of the database; by > default the realm returned by > krb5_default_local_realm(3) is used. > > modify \ > [-subtrees subtree_dn_list] > [-sscope search_scope] > [-containerref container_reference_dn] > [-r realm] > [-maxtktlife max_ticket_life] > [-maxrenewlife max_renewable_ticket_life] > [ticket_flags] > > Modifies the attributes of a realm. Options: > > -subtrees subtree_dn_list > Specifies the list of subtrees containing the > principals of a realm. The list contains the DNs > of the subtree objects separated by colon(:). This > list replaces the existing list. > > -sscope search_scope > Specifies the scope for searching the principals > under the subtrees. The possible values are 1 or > one (one level), 2 or sub (subtrees). > > -containerref container_reference_dn > Specifies the DN of the container object in which > the principals of a realm will be created. > > -maxtktlife max_ticket_life > Specifies maximum ticket life for principals in > this realm. > > -maxrenewlife max_renewable_ticket_life > Specifies maximum renewable life of tickets for > principals in this realm. > > ticket_flags > Specifies the ticket flags. If this option is not > specified, by default, none of the flags are set. > This means all the ticket options will be allowed > and no restriction will be set. > > The various flags are: > > {-|+}allow_postdated > -allow_postdated prohibits principals from obtain- > ing postdated tickets. (Sets the > KRB5_KDB_DISALLOW_POSTDATED flag.) > +allow_postdated clears this flag. > > {-|+}allow_forwardable > -allow_forwardable prohibits principals from > obtaining forwardable tickets. (Sets the > KRB5_KDB_DISALLOW_FORWARDABLE flag.) > +allow_forwardable clears this flag. > > {-|+}allow_renewable > -allow_renewable prohibits principals from obtain- > ing renewable tickets. (Sets the > KRB5_KDB_DISALLOW_RENEWABLE flag.) > +allow_renewable clears this flag. > > {-|+}allow_proxiable > > -allow_proxiable prohibits principals from obtain- > ing proxiable tickets. (Sets the > KRB5_KDB_DISALLOW_PROXIABLE flag.) > +allow_proxiable clears this flag. > > {-|+}allow_dup_skey > -allow_dup_skey Disables user-to-user authentica- > tion for principals by prohibiting principals from > obtaining a session key for another user. (Sets > the KRB5_KDB_DISALLOW_DUP_SKEY flag.) > +allow_dup_skey clears this flag. > > {-|+}requires_preauth > +requires_preauth requires principals to preau- > thenticate before being allowed to kinit. (Sets > the KRB5_KDB_REQUIRES_PRE_AUTH flag.) - > requires_preauth clears this flag. > > {-|+}requires_hwauth > +requires_hwauth requires principals to preauthen- > ticate using a hardware device before being > allowed to kinit. (Sets the > KRB5_KDB_REQUIRES_HW_AUTH flag.) -requires_hwauth > clears this flag. > > {-|+}allow_svr > -allow_svr prohibits the issuance of service tick- > ets for principals. (Sets the > KRB5_KDB_DISALLOW_SVR flag.) +allow_svr clears > this flag. > > {-|+}allow_tgs_req > -allow_tgs_req specifies that a Ticket-Granting > Service (TGS) request for a service ticket for > principals is not permitted. This option is use- > less for most things. +allow_tgs_req clears this > flag. The default is +allow_tgs_req. In effect, > -allow_tgs_req sets the > KRB5_KDB_DISALLOW_TGT_BASED flag on principals in > the database. > > {-|+}allow_tix > -allow_tix forbids the issuance of any tickets for > principals. +allow_tix clears this flag. The > default is +allow_tix. In effect, -allow_tix sets > the KRB5_KDB_DISALLOW_ALL_TIX flag on principals > in the database. > > {-|+}needchange > +needchange sets a flag in attributes field to > force a password change; -needchange clears it. > The default is -needchange. In effect, > +needchange sets the KRB5_KDB_REQUIRES_PWCHANGE > flag on principals in the database. > > {-|+}password_changing_service > +password_changing_service sets a flag in the > attributes field marking principal as a password > change service principal (useless for most > things). -password_changing_service clears the > flag. This flag intentionally has a long name. The > default is -password_changing_service. In effect, > +password_changing_service sets the > KRB5_KDB_PWCHANGE_SERVICE flag on principals in > the database. > > -r realm > Specifies the Kerberos realm of the database; by > default the realm returned by > krb5_default_local_realm(3) is used. > > > view [-r realm] > Displays the attributes of a realm. Options: > > -r realm > Specifies the Kerberos realm of the database; by > default the realm returned by > krb5_default_local_realm(3) is used. > > destroy [-f] [-r realm] > Destroys an existing realm. Options: > > -f If specified, will not prompt the user for confir- > mation. > > -r realm > Specifies the Kerberos realm of the database; by > default the realm returned by > krb5_default_local_realm(3) is used. > > list Lists the name of realms. > > stashsrvpw [-f filename] servicedn > Allows an administrator to store the password for ser- > vice object in a file so that KDC and Administration > server can use it to authenticate to the LDAP server. > Options: > > -f filename > Specifies the complete path of the service pass- > word file. By default, > /var/krb5/service_passwd is used. > > servicedn > Specifies Distinguished name (DN) of the service > object whose password is to be stored in file. > > > create_policy \ > [-r realm] > [-maxtktlife max_ticket_life] > [-maxrenewlife max_renewable_ticket_life] > [ticket_flags] > policy_name > > Creates a ticket policy in directory. Options: > > -r realm > Specifies the Kerberos realm of the database; by > default the realm returned by > krb5_default_local_realm(3) is used. > > -maxtktlife max_ticket_life > Specifies maximum ticket life for principals. > > -maxrenewlife max_renewable_ticket_life > Specifies maximum renewable life of tickets for > principals. > > ticket_flags > Specifies the ticket flags. If this option is not > specified, by default, none of the flags are set. > This means all the ticket options will be allowed > and no restriction will be set. > > The various flags are: > > {-|+}allow_postdated > -allow_postdated prohibits principals from obtain- > ing postdated tickets. (Sets the > KRB5_KDB_DISALLOW_POSTDATED flag.) > +allow_postdated clears this flag. > > {-|+}allow_forwardable > -allow_forwardable prohibits principals from > obtaining forwardable tickets. (Sets the > KRB5_KDB_DISALLOW_FORWARDABLE flag.) > +allow_forwardable clears this flag. > > {-|+}allow_renewable > -allow_renewable prohibits principals from obtain- > ing renewable tickets. (Sets the > KRB5_KDB_DISALLOW_RENEWABLE flag.) > +allow_renewable clears this flag. > > {-|+}allow_proxiable > -allow_proxiable prohibits principals from obtain- > ing proxiable tickets. (Sets the > KRB5_KDB_DISALLOW_PROXIABLE flag.) > +allow_proxiable clears this flag. > > {-|+}allow_dup_skey > -allow_dup_skey Disables user-to-user authentica- > tion for principals by prohibiting principals from > obtaining a session key for another user. (Sets > the KRB5_KDB_DISALLOW_DUP_SKEY flag.) > +allow_dup_skey clears this flag. > > {-|+}requires_preauth > +requires_preauth requires principals to preau- > thenticate before being allowed to kinit. (Sets > the KRB5_KDB_REQUIRES_PRE_AUTH flag.) - > requires_preauth clears this flag. > > {-|+}requires_hwauth > +requires_hwauth requires principals to preauthen- > ticate using a hardware device before being > allowed to kinit. (Sets the > KRB5_KDB_REQUIRES_HW_AUTH flag.) -requires_hwauth > clears this flag. > > {-|+}allow_svr > -allow_svr prohibits the issuance of service tick- > ets for principals. (Sets the > KRB5_KDB_DISALLOW_SVR flag.) +allow_svr clears > this flag. > > {-|+}allow_tgs_req > -allow_tgs_req specifies that a Ticket-Granting > Service (TGS) request for a service ticket for > principals is not permitted. This option is use- > less for most things. +allow_tgs_req clears this > flag. The default is +allow_tgs_req. In effect, > -allow_tgs_req sets the > KRB5_KDB_DISALLOW_TGT_BASED flag on principals in > the database. > > {-|+}allow_tix > -allow_tix forbids the issuance of any tickets for > principals. +allow_tix clears this flag. The > default is +allow_tix. In effect, -allow_tix sets > the KRB5_KDB_DISALLOW_ALL_TIX flag on principals > in the database. > > {-|+}needchange > +needchange sets a flag in attributes field to > force a password change; -needchange clears it. > The default is -needchange. In effect, > +needchange sets the KRB5_KDB_REQUIRES_PWCHANGE > flag on principals in the database. > > {-|+}password_changing_service > +password_changing_service sets a flag in the > attributes field marking principal as a password > change service principal (useless for most > things). -password_changing_service clears the > flag. This flag intentionally has a long name. The > default is -password_changing_service. In effect, > +password_changing_service sets the > KRB5_KDB_PWCHANGE_SERVICE flag on principals in > the database. > > policy_name > Specifies the name of the ticket policy. > > modify_policy \ > [-r realm] > [-maxtktlife max_ticket_life] > [-maxrenewlife max_renewable_ticket_life] > [ticket_flags] > policy_name > > Modifies the attributes of a ticket policy. Options are > same as create_policy. > > -r realm > Specifies the Kerberos realm of the database; by > default the realm returned by > krb5_default_local_realm(3) is used. > > view_policy [-r realm] policy_name > > Displays the attributes of a ticket policy. Options: > > policy_name > Specifies the name of the ticket policy. > > destroy_policy [-r realm] [-force] policy_name > > Destroys an existing ticket policy. Options: > > -r realm > Specifies the Kerberos realm of the database; by > default the realm returned by > krb5_default_local_realm(3) is used. > > -force > Forces the deletion of the policy object. If not > specified, will be prompted for confirmation while > deleting the policy. Enter yes to confirm the > deletion. > > policy_name > Specifies the name of the ticket policy. > > list_policy [-r realm] > > Lists the ticket policies in realm if specified or in > the default realm. Options: > > -r realm > Specifies the Kerberos realm of the database; by > default the realm returned by > krb5_default_local_realm(3) is used. > > > Stability Level: Committed > > 4.6. Doc Impact: > > There will be a new man page for kdb5_ldap_util (see above). > There will also be impact to the Solaris sysadmin guide to > describe how to use the utility. > > 4.7. Admin/Config Impact: > > In addition to the changes listed in the one pager for the PSARC > 2006/277 case there will use of the kdb5_ldap_util to manage . > > 4.8. HA Impact: > > No additional HA impact. > > 4.9. I18N/L10N Impact: > > There are about 252 new messages. > > 4.10. Packaging & Delivery: > > In addition to the packaging changes described in the 2006/277 > one pager usr/sbin/kdb5_ldap_util will be added to the SUNWkdcu > package. > > 4.11. Security Impact: > > kdb5_ldap_util provides the option to create/manage a new file > that contains hex encoded passwords for the LDAP bind DN's for > KDC, kadmind and kpasswd. The security of this file will rely > on filesystem permissions that allow only root to read/write > this file. This is similar to the currently supported KDC > master key stash file. The default location of this file is: > /var/krb5/service_passwd > > In addition kdb5_ldap_util supports a "create -P " > command line. While this violates Solaris policy on allowing > clear-text passwords on command lines, there is a precedent set > by the existing kdb5_util which supports a similar "create -P > " command line. Solaris Kerberos has generally tried > to stay consistent with MIT in regards to interfaces which is > why this -P flag is included in this fast track. > > 4.12. Dependencies: > > The dependencies are the same as for the PSARC 2006/277 case. > > 5. Reference Documents: > > Solaris Kerberos home page: http://kerberos.eng/ > > 6. Resources and Schedule: > > See one pager for PSARC 2006/277 LDAP Backend for Kerberos KDC. > > 7. Prototype Availability: > 7.1. Prototype Availability: > > N/A > > 7.2. Prototype Cost: > > N/A From gww@eng.sun.com Tue Jun 19 14:01:03 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5JL12gW021505 for ; Tue, 19 Jun 2007 14:01:03 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5JKxKLP009191; Tue, 19 Jun 2007 21:59:24 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJW00L09IAXBL00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 19 Jun 2007 13:59:21 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJW005KRIAXSI90@nwk-avmta-1.sfbay.Sun.COM>; Tue, 19 Jun 2007 13:59:21 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5JKxL7E004949; Tue, 19 Jun 2007 13:59:21 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id l5JL25e0022318; Tue, 19 Jun 2007 14:02:05 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id l5JL25qc022317; Tue, 19 Jun 2007 14:02:05 -0700 (PDT) Date: Tue, 19 Jun 2007 14:02:05 -0700 (PDT) From: Gary Winiger Subject: Re: krb5_ldap_util command for Solaris Kerberos [PSARC/2007/368 FastTrack timeout 06/26/,2007] To: PSARC-ext@sun.com, wyllys.ingersoll@sun.com Cc: krb5-core@sun.com Message-id: <200706192102.l5JL25qc022317@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-Sun-Charset: US-ASCII X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 658 > I am sponsoring the following fast-track for Will Fiveash. > > * The release binding is patch/micro. > * The interface stability is committed. Presumably the intent is to follow MIT. Is Committed too strong? Presumably subcommands such as view, list, view_policy, list_policy write to stdout. Is that output also Committed? If not, what is the proposed interface stability? > 2. Project Summary > 2.1. Project Description: > > This fasttrack is about including a new utility, kdb5_ldap_util, > as part of an earlier fast track: Rewind; replay: And what Rights Profile includes this command? And with what Rights? Gary.. From William.Fiveash@sun.com Tue Jun 19 16:56:47 2007 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5JNul60026782 for ; Tue, 19 Jun 2007 16:56:47 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5JNsZsK014164; Tue, 19 Jun 2007 17:54:36 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJW0010NQFVU900@nwk-avmta-2.sfbay.sun.com>; Tue, 19 Jun 2007 16:55:07 -0700 (PDT) Received: from unknown ([129.153.128.225]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJW00KNUQFUTZ60@nwk-avmta-2.sfbay.sun.com>; Tue, 19 Jun 2007 16:55:07 -0700 (PDT) Received: from unknown (localhost [127.0.0.1]) by unknown (8.14.1+Sun/8.14.1) with ESMTP id l5JNt5sY019358; Tue, 19 Jun 2007 18:55:05 -0500 (CDT) Received: (from willf@localhost) by unknown (8.14.1+Sun/8.14.1/Submit) id l5JNt53x019357; Tue, 19 Jun 2007 18:55:05 -0500 (CDT) Date: Tue, 19 Jun 2007 18:55:05 -0500 From: Will Fiveash Subject: Re: krb5_ldap_util command for Solaris Kerberos [PSARC/2007/368 FastTrack timeout 06/26/,2007] In-reply-to: <200706192102.l5JL25qc022317@marduk.eng.sun.com> To: Gary Winiger Cc: PSARC-ext@sun.com, Wyllys.Ingersoll@sun.com, krb5-core@sun.com Mail-followup-to: Gary Winiger , PSARC-ext@sun.com, Wyllys.Ingersoll@sun.com, krb5-core@sun.com Message-id: <20070619235505.GZ1999@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.2.0.264296 References: <200706192102.l5JL25qc022317@marduk.eng.sun.com> X-Authentication-warning: unknown: willf set sender to William.Fiveash@sun.com using -f User-Agent: Mutt/1.5.11 Status: RO Content-Length: 1521 On Tue, Jun 19, 2007 at 02:02:05PM -0700, Gary Winiger wrote: > > I am sponsoring the following fast-track for Will Fiveash. > > > > * The release binding is patch/micro. > > * The interface stability is committed. > > Presumably the intent is to follow MIT. Is Committed too > strong? Presumably subcommands such as view, list, view_policy, > list_policy write to stdout. Is that output also Committed? > If not, what is the proposed interface stability? The krb team is discussing this now but my take is since this is a new command and MIT may well change the interface I would say Volatile. Also note that in the interface description it shows: SYNOPSIS kdb5_ldap_util [-D user_dn [-w passwd]] [-H ldapuri] command [command_options] (note the -w passwd). The MIT version of this util provides that arg which allows one to provide the LDAP bind password on the command line. This violates the Solaris CLI password policy so I wasn't sure if I should remove this flag or not. If I remove it then this is a diff as compared to the MIT interface. > > 2. Project Summary > > 2.1. Project Description: > > > > This fasttrack is about including a new utility, kdb5_ldap_util, > > as part of an earlier fast track: > > Rewind; replay: And what Rights Profile includes this command? > And with what Rights? The Rights Profile and Rights will be the same as those for kdb5_util: Kerberos Server Management:solaris:cmd:::/usr/sbin/kdb5_util:euid=0;privs=none -- Will Fiveash From gww@eng.sun.com Tue Jun 19 17:07:47 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5K07kNs027121 for ; Tue, 19 Jun 2007 17:07:47 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5K066J4008507; Wed, 20 Jun 2007 01:06:08 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJW00L01QY7TB00@brm-avmta-1.central.sun.com>; Tue, 19 Jun 2007 18:06:07 -0600 (MDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJW0077MQY63JC0@brm-avmta-1.central.sun.com>; Tue, 19 Jun 2007 18:06:06 -0600 (MDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5K066aS024284; Tue, 19 Jun 2007 17:06:06 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id l5K08oj3022692; Tue, 19 Jun 2007 17:08:50 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id l5K08oAf022691; Tue, 19 Jun 2007 17:08:50 -0700 (PDT) Date: Tue, 19 Jun 2007 17:08:50 -0700 (PDT) From: Gary Winiger Subject: Re: krb5_ldap_util command for Solaris Kerberos [PSARC/2007/368 FastTrack timeout 06/26/,2007] To: gww@eng.sun.com, William.Fiveash@sun.com Cc: PSARC-ext@sun.com, Wyllys.Ingersoll@sun.com, krb5-core@sun.com Message-id: <200706200008.l5K08oAf022691@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-Sun-Charset: US-ASCII X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 1819 > The krb team is discussing this now but my take is since this is a new > command and MIT may well change the interface I would say Volatile. > Also note that in the interface description it shows: > > SYNOPSIS > kdb5_ldap_util [-D user_dn [-w passwd]] [-H ldapuri] command > [command_options] > > (note the -w passwd). The MIT version of this util provides that arg > which allows one to provide the LDAP bind password on the command line. > This violates the Solaris CLI password policy so I wasn't sure if I > should remove this flag or not. If I remove it then this is a diff as > compared to the MIT interface. And the spec doesn't say much about it: COMMAND-LINE OPTIONS -D user_dn Specifies the Distinguished name (DN) of the user who has sufficient rights to perform the operation on the LDAP server. -H ldapuri Specifies the URI of the LDAP server. What happens if the optional -w is omitted? Does it prompt or find the passwd somewhere else. The policy is generally interpreted to be requiring a password on the command line is not acceptable. If the command comes from another source and it has an optional CLI password option, that option may be preserved, though it should be documented as not a safe thing to do. Gary.. > > > > 2. Project Summary > > > 2.1. Project Description: > > > > > > This fasttrack is about including a new utility, kdb5_ldap_util, > > > as part of an earlier fast track: > > > > Rewind; replay: And what Rights Profile includes this command? > > And with what Rights? > > The Rights Profile and Rights will be the same as those for kdb5_util: > Kerberos Server Management:solaris:cmd:::/usr/sbin/kdb5_util:euid=0;privs=none > > -- > Will Fiveash > From William.Fiveash@Sun.COM Tue Jun 19 17:26:38 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5K0Qba4027241 for ; Tue, 19 Jun 2007 17:26:37 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5K0OrTX014187; Wed, 20 Jun 2007 01:24:56 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJW00H3JRTJ3Z00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 19 Jun 2007 17:24:55 -0700 (PDT) Received: from unknown ([129.153.128.225]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJW00798RTE6OD0@nwk-avmta-1.sfbay.Sun.COM>; Tue, 19 Jun 2007 17:24:51 -0700 (PDT) Received: from unknown (localhost [127.0.0.1]) by unknown (8.14.1+Sun/8.14.1) with ESMTP id l5K0On36019445; Tue, 19 Jun 2007 19:24:50 -0500 (CDT) Received: (from willf@localhost) by unknown (8.14.1+Sun/8.14.1/Submit) id l5K0OnXF019444; Tue, 19 Jun 2007 19:24:49 -0500 (CDT) Date: Tue, 19 Jun 2007 19:24:49 -0500 From: Will Fiveash Subject: Re: krb5_ldap_util command for Solaris Kerberos [PSARC/2007/368 FastTrack timeout 06/26/,2007] In-reply-to: <200706200008.l5K08oAf022691@marduk.eng.sun.com> To: Gary Winiger Cc: William.Fiveash@Sun.COM, PSARC-ext@Sun.COM, Wyllys.Ingersoll@Sun.COM, krb5-core@Sun.COM Mail-followup-to: Gary Winiger , PSARC-ext@sun.com, Wyllys.Ingersoll@sun.com, krb5-core@sun.com Message-id: <20070620002449.GA1999@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.2.0.264296 References: <200706200008.l5K08oAf022691@marduk.eng.sun.com> X-Authentication-warning: unknown: willf set sender to William.Fiveash@sun.com using -f User-Agent: Mutt/1.5.11 Status: RO Content-Length: 2109 On Tue, Jun 19, 2007 at 05:08:50PM -0700, Gary Winiger wrote: > > The krb team is discussing this now but my take is since this is a new > > command and MIT may well change the interface I would say Volatile. > > Also note that in the interface description it shows: > > > > SYNOPSIS > > kdb5_ldap_util [-D user_dn [-w passwd]] [-H ldapuri] command > > [command_options] > > > > (note the -w passwd). The MIT version of this util provides that arg > > which allows one to provide the LDAP bind password on the command line. > > This violates the Solaris CLI password policy so I wasn't sure if I > > should remove this flag or not. If I remove it then this is a diff as > > compared to the MIT interface. > > And the spec doesn't say much about it: > > COMMAND-LINE OPTIONS > -D user_dn > Specifies the Distinguished name (DN) of the user who > has sufficient rights to perform the operation on the > LDAP server. > > -H ldapuri > Specifies the URI of the LDAP server. It should be (from MIT man page): -w passwd Specifies the password of user_dn. This option is not recommended. > What happens if the optional -w is omitted? Does it prompt > or find the passwd somewhere else. It will prompt. > The policy is generally interpreted to be requiring a password > on the command line is not acceptable. If the command comes from > another source and it has an optional CLI password option, that > option may be preserved, though it should be documented as not > a safe thing to do. Understood but there are existing krb utilities that violate this: /usr/sbin/kadmin [-r realm] [-p principal] [-q query] [-s admin_server [:port]] [ [-c credential_cache] | [-k [-t keytab]] | [-w password]] /usr/sbin/kdb5_util [-d dbname] [-f stashfile_name] [-k mkeytype] [-m ] [-M mkeyname] [-P password] [-r realm] cmd I can easily disable -w passwd in kdb5_ldap_util but I wasn't sure if it would be allowed for MIT compat. -- Will Fiveash From sommerfeld@sun.com Tue Jun 19 17:30:56 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5K0UtL8027287 for ; Tue, 19 Jun 2007 17:30:56 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5K0TD5U002948; Wed, 20 Jun 2007 08:29:17 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJW00309S0QDT00@nwk-avmta-2.sfbay.sun.com>; Tue, 19 Jun 2007 17:29:14 -0700 (PDT) Received: from eastmail1bur.East.Sun.COM ([129.148.9.49]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJW00KH1S0PU490@nwk-avmta-2.sfbay.sun.com>; Tue, 19 Jun 2007 17:29:14 -0700 (PDT) Received: from thunk.east.sun.com (thunk.East.Sun.COM [129.148.174.66]) by eastmail1bur.East.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5K0TBCT015281; Tue, 19 Jun 2007 20:29:11 -0400 (EDT) Received: from [IPv6:::1] (localhost [IPv6:::1]) by thunk.east.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5K0T8vM006226; Tue, 19 Jun 2007 20:29:08 -0400 (EDT) Date: Tue, 19 Jun 2007 20:29:06 -0400 From: Bill Sommerfeld Subject: Re: krb5_ldap_util command for Solaris Kerberos [PSARC/2007/368 FastTrack timeout 06/26/,2007] In-reply-to: <20070620002449.GA1999@sun.com> To: Will Fiveash Cc: Gary Winiger , Wyllys.Ingersoll@sun.com, krb5-core@sun.com, PSARC-ext@sun.com Message-id: <1182299346.3708.101.camel@thunk> MIME-version: 1.0 X-Mailer: Evolution 2.8.1.1 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200706200008.l5K08oAf022691@marduk.eng.sun.com> <20070620002449.GA1999@sun.com> Status: RO Content-Length: 1042 On Tue, 2007-06-19 at 19:24 -0500, Will Fiveash wrote: > > What happens if the optional -w is omitted? Does it prompt > > or find the passwd somewhere else. > > It will prompt. Is there any way to tell it to get the password from a file named on the command line? > > The policy is generally interpreted to be requiring a password > > on the command line is not acceptable. If the command comes from > > another source and it has an optional CLI password option, that > > option may be preserved, though it should be documented as not > > a safe thing to do. > > Understood but there are existing krb utilities that violate this: > > /usr/sbin/kadmin [-r realm] [-p principal] [-q query] > [-s admin_server [:port]] [ [-c credential_cache] > | [-k [-t keytab]] | [-w password]] > > /usr/sbin/kdb5_util [-d dbname] [-f stashfile_name] > [-k mkeytype] [-m ] [-M mkeyname] [-P password] [-r realm] > cmd > if I'm interpreting correctly, both of these have 'get password from file' options... From Shawn.Emery@Sun.COM Tue Jun 19 17:38:31 2007 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5K0cV09027399 for ; Tue, 19 Jun 2007 17:38:31 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5K0aKMu022881; Tue, 19 Jun 2007 18:36:20 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJW00I0BSDGBF00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 19 Jun 2007 17:36:52 -0700 (PDT) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJW00HS5SDEXB00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 19 Jun 2007 17:36:50 -0700 (PDT) Received: from fe-amer-03.sun.com ([192.18.108.177]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id l5K0aoUj008338; Wed, 20 Jun 2007 00:36:50 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0JJW00401S9TUK00@mail-amer.sun.com> (original mail from Shawn.Emery@Sun.COM); Tue, 19 Jun 2007 18:36:50 -0600 (MDT) Received: from [129.150.48.17] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0JJW008TESDD3U67@mail-amer.sun.com>; Tue, 19 Jun 2007 18:36:49 -0600 (MDT) Date: Tue, 19 Jun 2007 18:35:47 -0600 From: Shawn M Emery Subject: Re: krb5_ldap_util command for Solaris Kerberos [PSARC/2007/368 FastTrack timeout 06/26/,2007] In-reply-to: <1182299346.3708.101.camel@thunk> Sender: Shawn.Emery@Sun.COM To: Bill Sommerfeld Cc: Will Fiveash , Gary Winiger , Wyllys.Ingersoll@Sun.COM, krb5-core@Sun.COM, PSARC-ext@Sun.COM Message-id: <46787663.3030100@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200706200008.l5K08oAf022691@marduk.eng.sun.com> <20070620002449.GA1999@sun.com> <1182299346.3708.101.camel@thunk> User-Agent: Thunderbird 2.0.0.0 (X11/20070419) Status: RO Content-Length: 1255 Bill Sommerfeld wrote: > On Tue, 2007-06-19 at 19:24 -0500, Will Fiveash wrote: > > >>> What happens if the optional -w is omitted? Does it prompt >>> or find the passwd somewhere else. >>> >> It will prompt. >> > > Is there any way to tell it to get the password from a file named on the > command line? > Not that I'm aware of. >>> The policy is generally interpreted to be requiring a password >>> on the command line is not acceptable. If the command comes from >>> another source and it has an optional CLI password option, that >>> option may be preserved, though it should be documented as not >>> a safe thing to do. >>> >> Understood but there are existing krb utilities that violate this: >> >> /usr/sbin/kadmin [-r realm] [-p principal] [-q query] >> [-s admin_server [:port]] [ [-c credential_cache] >> | [-k [-t keytab]] | [-w password]] >> >> /usr/sbin/kdb5_util [-d dbname] [-f stashfile_name] >> [-k mkeytype] [-m ] [-M mkeyname] [-P password] [-r realm] >> cmd >> >> > > if I'm interpreting correctly, both of these have 'get password from > file' options... > Unfortunately, no. New commands, such as kdcmgr(1M), will/do have this option though. -- Shawn. From William.Fiveash@sun.com Tue Jun 19 17:54:58 2007 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5K0svj9028089 for ; Tue, 19 Jun 2007 17:54:58 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5K0qkiO025795; Tue, 19 Jun 2007 18:52:47 -0600 (MDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJW00103T4VOD00@brm-avmta-1.central.sun.com>; Tue, 19 Jun 2007 18:53:19 -0600 (MDT) Received: from unknown ([129.153.128.225]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJW007LVT4U3JE0@brm-avmta-1.central.sun.com>; Tue, 19 Jun 2007 18:53:19 -0600 (MDT) Received: from unknown (localhost [127.0.0.1]) by unknown (8.14.1+Sun/8.14.1) with ESMTP id l5K0rILq019456; Tue, 19 Jun 2007 19:53:18 -0500 (CDT) Received: (from willf@localhost) by unknown (8.14.1+Sun/8.14.1/Submit) id l5K0rHU3019455; Tue, 19 Jun 2007 19:53:17 -0500 (CDT) Date: Tue, 19 Jun 2007 19:53:17 -0500 From: Will Fiveash Subject: Re: krb5_ldap_util command for Solaris Kerberos [PSARC/2007/368 FastTrack timeout 06/26/,2007] In-reply-to: <1182299346.3708.101.camel@thunk> To: Bill Sommerfeld Cc: Will Fiveash , Gary Winiger , Wyllys.Ingersoll@sun.com, krb5-core@sun.com, PSARC-ext@sun.com Mail-followup-to: Bill Sommerfeld , Gary Winiger , Wyllys.Ingersoll@sun.com, krb5-core@sun.com, PSARC-ext@sun.com Message-id: <20070620005317.GB1999@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.2.0.264296 References: <200706200008.l5K08oAf022691@marduk.eng.sun.com> <20070620002449.GA1999@sun.com> <1182299346.3708.101.camel@thunk> X-Authentication-warning: unknown: willf set sender to William.Fiveash@sun.com using -f User-Agent: Mutt/1.5.11 Status: RO Content-Length: 1391 On Tue, Jun 19, 2007 at 08:29:06PM -0400, Bill Sommerfeld wrote: > On Tue, 2007-06-19 at 19:24 -0500, Will Fiveash wrote: > > > > What happens if the optional -w is omitted? Does it prompt > > > or find the passwd somewhere else. > > > > It will prompt. > > Is there any way to tell it to get the password from a file named on the > command line? Nope. We could modify this but this is the way the MIT kdb5_ldap_util command currently behaves. > > > The policy is generally interpreted to be requiring a password > > > on the command line is not acceptable. If the command comes from > > > another source and it has an optional CLI password option, that > > > option may be preserved, though it should be documented as not > > > a safe thing to do. > > > > Understood but there are existing krb utilities that violate this: > > > > /usr/sbin/kadmin [-r realm] [-p principal] [-q query] > > [-s admin_server [:port]] [ [-c credential_cache] > > | [-k [-t keytab]] | [-w password]] > > > > /usr/sbin/kdb5_util [-d dbname] [-f stashfile_name] > > [-k mkeytype] [-m ] [-M mkeyname] [-P password] [-r realm] > > cmd > > > > if I'm interpreting correctly, both of these have 'get password from > file' options... No the kadmin -w password and kdb5_util -P password are from CLI. If not present they prompt for the password. -- Will Fiveash From James.McPherson@sun.com Tue Jun 19 18:21:04 2007 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5K1L4bN028837 for ; Tue, 19 Jun 2007 18:21:04 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5K1JQlR006216; Tue, 19 Jun 2007 18:19:27 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJW00505UCEW400@nwk-avmta-2.sfbay.sun.com>; Tue, 19 Jun 2007 18:19:26 -0700 (PDT) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJW00KZPUCCTZC0@nwk-avmta-2.sfbay.sun.com>; Tue, 19 Jun 2007 18:19:25 -0700 (PDT) Received: from fe-apac-05.sun.com (fe-apac-05.sun.com [192.18.19.176] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id l5K1JOlU011375; Wed, 20 Jun 2007 01:19:24 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0JJW00F01U8A4300@mail-apac.sun.com> (original mail from James.McPherson@Sun.COM); Wed, 20 Jun 2007 09:19:24 +0800 (SGT) Received: from [192.168.1.35] ([59.167.244.18]) by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0JJW00DAZUC79553@mail-apac.sun.com>; Wed, 20 Jun 2007 09:19:21 +0800 (SGT) Date: Wed, 20 Jun 2007 11:19:19 +1000 From: "James C. McPherson" Subject: Re: krb5_ldap_util command for Solaris Kerberos [PSARC/2007/368 FastTrack timeout 06/26/,2007] In-reply-to: <4677F5F5.1080401@sun.com> Sender: James.McPherson@sun.com To: Wyllys Ingersoll Cc: PSARC-ext@sun.com, krb5-core@sun.com Reply-to: James.McPherson@sun.com Message-id: <46788097.5060704@Sun.COM> Organization: Sun Microsystems MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=UTF-8 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <4677F5F5.1080401@sun.com> User-Agent: Thunderbird 2.0b2 (X11/20070123) Status: RO Content-Length: 577 Wyllys Ingersoll wrote: > I am sponsoring the following fast-track for Will Fiveash. > > * The release binding is patch/micro. > * The interface stability is committed. > * The timer is set for 1 week (6/27/2007) > > - Wyllys Ingersoll Should something marked "This information is Sun XXXXXXXXXXX/XXXXXXXXXXXX: XXXXXXXX XXX XXXX: XXXXXXXXXXX XXXX-XX-XXXX" and containing names of customers really have been sent to psarc-ext? Couldn't you have redacted the customer names before sending it out? James C. McPherson -- Solaris kernel software engineer Sun Microsystems From wyllys.ingersoll@sun.com Tue Jun 19 18:51:41 2007 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5K1pfsF029338 for ; Tue, 19 Jun 2007 18:51:41 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5K1o1I9012304; Tue, 19 Jun 2007 18:50:01 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJW00501VRDXU00@brm-avmta-1.central.sun.com>; Tue, 19 Jun 2007 19:50:01 -0600 (MDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJW004ORVRB9E20@brm-avmta-1.central.sun.com>; Tue, 19 Jun 2007 19:49:59 -0600 (MDT) Received: from [10.7.251.182] (punchin-wyllys.SFBay.Sun.COM [10.7.251.182]) by jurassic-x4600.sfbay.sun.com (8.14.1+Sun/8.14.1) with ESMTP id l5K1nwD6478334 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 19 Jun 2007 18:49:58 -0700 (PDT) Date: Tue, 19 Jun 2007 21:49:48 -0400 From: Wyllys Ingersoll Subject: Re: krb5_ldap_util command for Solaris Kerberos [PSARC/2007/368 FastTrack timeout 06/26/,2007] In-reply-to: <46788097.5060704@Sun.COM> To: James.McPherson@sun.com Cc: PSARC-ext@sun.com, krb5-core@sun.com Message-id: <467887BC.5080309@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=UTF-8; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <4677F5F5.1080401@sun.com> <46788097.5060704@Sun.COM> User-Agent: Thunderbird 2.0.0.0 (X11/20070521) Status: RO Content-Length: 878 James C. McPherson wrote: > Wyllys Ingersoll wrote: >> I am sponsoring the following fast-track for Will Fiveash. >> >> * The release binding is patch/micro. >> * The interface stability is committed. >> * The timer is set for 1 week (6/27/2007) >> >> - Wyllys Ingersoll > > > Should something marked > > > "This information is > XXXXXXXXXXX/XXXXXXXXXXXX: XXXXXXXX XXX XXXX: XXXXXXXXXXX XXXX-XX-XXXX" > > and containing names of customers really have been sent > to psarc-ext? I think the form used was just an old template and the submitter forgot to edit that stuff out. Likewise, I should have caught it but didn't notice it either. It is not actually "need-to-know" or we wouldn't have sent it to psarc-ext. > > Couldn't you have redacted the customer names before > sending it out? Yes, probably, but it's a little late to do anything about it now. -Wyllys From William.Fiveash@sun.com Wed Jun 20 09:51:28 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5KGpRMx020502 for ; Wed, 20 Jun 2007 09:51:28 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5KGnbuQ010067; Thu, 21 Jun 2007 00:49:46 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJY00K0N1EXJM00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 20 Jun 2007 09:49:45 -0700 (PDT) Received: from unknown ([129.153.128.225]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJY00IZ71EV4Q30@nwk-avmta-1.sfbay.Sun.COM>; Wed, 20 Jun 2007 09:49:44 -0700 (PDT) Received: from unknown (localhost [127.0.0.1]) by unknown (8.14.1+Sun/8.14.1) with ESMTP id l5KGnh8e019746; Wed, 20 Jun 2007 11:49:43 -0500 (CDT) Received: (from willf@localhost) by unknown (8.14.1+Sun/8.14.1/Submit) id l5KGnhQh019745; Wed, 20 Jun 2007 11:49:43 -0500 (CDT) Date: Wed, 20 Jun 2007 11:49:43 -0500 From: Will Fiveash Subject: Re: krb5_ldap_util command for Solaris Kerberos [PSARC/2007/368 FastTrack timeout 06/26/,2007] In-reply-to: <467887BC.5080309@sun.com> To: Wyllys Ingersoll Cc: James.McPherson@sun.com, PSARC-ext@sun.com, krb5-core@sun.com Mail-followup-to: Wyllys Ingersoll , James.McPherson@sun.com, PSARC-ext@sun.com, krb5-core@sun.com Message-id: <20070620164943.GH1999@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.2.0.264296 References: <4677F5F5.1080401@sun.com> <46788097.5060704@Sun.COM> <467887BC.5080309@sun.com> X-Authentication-warning: unknown: willf set sender to William.Fiveash@sun.com using -f User-Agent: Mutt/1.5.11 Status: RO Content-Length: 1179 On Tue, Jun 19, 2007 at 09:49:48PM -0400, Wyllys Ingersoll wrote: > James C. McPherson wrote: > >Wyllys Ingersoll wrote: > >>I am sponsoring the following fast-track for Will Fiveash. > >> > >>* The release binding is patch/micro. > >>* The interface stability is committed. > >>* The timer is set for 1 week (6/27/2007) > >> > >>- Wyllys Ingersoll > > > > > >Should something marked > > > > > >"This information is > >XXXXXXXXXXX/XXXXXXXXXXXX: XXXXXXXX XXX XXXX: XXXXXXXXXXX XXXX-XX-XXXX" > > > >and containing names of customers really have been sent > >to psarc-ext? > > > I think the form used was just an old template and the submitter > forgot to edit that stuff out. Likewise, I should have caught it but > didn't notice it either. It is not actually "need-to-know" or we wouldn't > have sent it to psarc-ext. Take a look at: http://sac.eng.sun.com/sdf/SDF-Templates/onepager.txt I see: Template Version: %Z%%M% %I% %E% SMI This information is Sun XXXXXXXXXXX/XXXXXXXXXXXX: XXXXXXXX XXX XXXX: XXXXXXXXXXX XXXX-XX-XXXX Copyright 2006 Sun Microsystems Seems like a couple things need to be fixed in the official template. -- Will Fiveash From alan.coopersmith@sun.com Wed Jun 20 10:02:07 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5KH26e6021539 for ; Wed, 20 Jun 2007 10:02:07 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5KH0L2I021711; Wed, 20 Jun 2007 18:00:27 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJY000051WPQI00@brm-avmta-1.central.sun.com>; Wed, 20 Jun 2007 11:00:25 -0600 (MDT) Received: from sfbaymail1sca.SFBay.Sun.COM ([129.145.154.35]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJY00HA41WNVB50@brm-avmta-1.central.sun.com>; Wed, 20 Jun 2007 11:00:24 -0600 (MDT) Received: from [192.168.0.101] (vpn-129-150-33-201.Central.Sun.COM [129.150.33.201]) by sfbaymail1sca.SFBay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5KH0IgM026373; Wed, 20 Jun 2007 10:00:21 -0700 (PDT) Date: Wed, 20 Jun 2007 09:59:06 -0700 From: Alan Coopersmith Subject: Re: krb5_ldap_util command for Solaris Kerberos [PSARC/2007/368 FastTrack timeout 06/26/,2007] In-reply-to: <20070620164943.GH1999@sun.com> To: Wyllys Ingersoll , James.McPherson@sun.com, PSARC-ext@sun.com, krb5-core@sun.com Message-id: <46795CDA.1050609@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <4677F5F5.1080401@sun.com> <46788097.5060704@Sun.COM> <467887BC.5080309@sun.com> <20070620164943.GH1999@sun.com> User-Agent: Thunderbird 1.5.0.4 (X11/20060602) Status: RO Content-Length: 476 Will Fiveash wrote: > Take a look at: http://sac.eng.sun.com/sdf/SDF-Templates/onepager.txt Actually, please don't. The One Pager is almost always the wrong form to fill out for an ARC fast-track - all the stuff about marketing and business requirements is not useful for ARC review and just gets in the way of both ARC review and publishing to OpenSolaris. -- -Alan Coopersmith- alan.coopersmith@sun.com Sun Microsystems, Inc. - X Window System Engineering From William.Fiveash@sun.com Wed Jun 20 10:32:47 2007 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5KHWkCq022710 for ; Wed, 20 Jun 2007 10:32:47 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5KHUYJd005937; Wed, 20 Jun 2007 11:30:35 -0600 (MDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJY002193BUOL00@brm-avmta-1.central.sun.com>; Wed, 20 Jun 2007 11:31:06 -0600 (MDT) Received: from unknown ([129.153.128.225]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJY00HAY3BTVD70@brm-avmta-1.central.sun.com>; Wed, 20 Jun 2007 11:31:05 -0600 (MDT) Received: from unknown (localhost [127.0.0.1]) by unknown (8.14.1+Sun/8.14.1) with ESMTP id l5KHV5I0019789; Wed, 20 Jun 2007 12:31:05 -0500 (CDT) Received: (from willf@localhost) by unknown (8.14.1+Sun/8.14.1/Submit) id l5KHV46l019788; Wed, 20 Jun 2007 12:31:04 -0500 (CDT) Date: Wed, 20 Jun 2007 12:31:04 -0500 From: Will Fiveash Subject: Re: krb5_ldap_util command for Solaris Kerberos [PSARC/2007/368 FastTrack timeout 06/26/,2007] In-reply-to: <20070620002449.GA1999@sun.com> To: Gary Winiger , PSARC-ext@sun.com, Wyllys.Ingersoll@sun.com, krb5-core@sun.com Mail-followup-to: Gary Winiger , PSARC-ext@Sun.COM, Wyllys.Ingersoll@Sun.COM, krb5-core@Sun.COM Message-id: <20070620173104.GK1999@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.2.0.264296 References: <200706200008.l5K08oAf022691@marduk.eng.sun.com> <20070620002449.GA1999@sun.com> X-Authentication-warning: unknown: willf set sender to William.Fiveash@sun.com using -f User-Agent: Mutt/1.5.11 Status: RO Content-Length: 2451 On Tue, Jun 19, 2007 at 07:24:49PM -0500, Will Fiveash wrote: > On Tue, Jun 19, 2007 at 05:08:50PM -0700, Gary Winiger wrote: > > > The krb team is discussing this now but my take is since this is a new > > > command and MIT may well change the interface I would say Volatile. > > > Also note that in the interface description it shows: > > > > > > SYNOPSIS > > > kdb5_ldap_util [-D user_dn [-w passwd]] [-H ldapuri] command > > > [command_options] > > > > > > (note the -w passwd). The MIT version of this util provides that arg > > > which allows one to provide the LDAP bind password on the command line. > > > This violates the Solaris CLI password policy so I wasn't sure if I > > > should remove this flag or not. If I remove it then this is a diff as > > > compared to the MIT interface. > > > > And the spec doesn't say much about it: > > > > COMMAND-LINE OPTIONS > > -D user_dn > > Specifies the Distinguished name (DN) of the user who > > has sufficient rights to perform the operation on the > > LDAP server. > > > > -H ldapuri > > Specifies the URI of the LDAP server. > > It should be (from MIT man page): > > -w passwd > Specifies the password of user_dn. This option is not > recommended. > > > What happens if the optional -w is omitted? Does it prompt > > or find the passwd somewhere else. > > It will prompt. > > > The policy is generally interpreted to be requiring a password > > on the command line is not acceptable. If the command comes from > > another source and it has an optional CLI password option, that > > option may be preserved, though it should be documented as not > > a safe thing to do. > > Understood but there are existing krb utilities that violate this: Sorry, I didn't read your reply carefully. I believe kdb5_ldap_util falls under the "comes from another source ... that option may be preserved". > /usr/sbin/kadmin [-r realm] [-p principal] [-q query] > [-s admin_server [:port]] [ [-c credential_cache] > | [-k [-t keytab]] | [-w password]] > > /usr/sbin/kdb5_util [-d dbname] [-f stashfile_name] > [-k mkeytype] [-m ] [-M mkeyname] [-P password] [-r realm] > cmd > > I can easily disable -w passwd in kdb5_ldap_util but I wasn't sure if it > would be allowed for MIT compat. > > -- > Will Fiveash -- Will Fiveash From sacadmin Thu Jun 28 12:35:24 2007 Received: from sfbaymail2sca.sfbay.sun.com (sfbaymail2sca.SFBay.Sun.COM [129.145.155.42]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5SJZOQc016795 for ; Thu, 28 Jun 2007 12:35:24 -0700 (PDT) Received: from sca-es-mail-2.sun.com (sca-es-mail-2.Sun.COM [192.18.43.133]) by sfbaymail2sca.sfbay.sun.com (8.13.6+Sun/8.12.10/ENSMAIL,v2.2) with ESMTP id l5SJXdvg000114 for ; Thu, 28 Jun 2007 12:33:39 -0700 (PDT) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id l5SJXY7e010716 for ; Thu, 28 Jun 2007 12:33:34 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JKD0090120ZHC00@fe-sfbay-10.sun.com> (original mail from John.Plocher@Sun.COM) for psarc-record@sac.sfbay.sun.com; Thu, 28 Jun 2007 12:33:34 -0700 (PDT) Received: from [129.146.58.87] by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JKD00DGF2BULT10@fe-sfbay-10.sun.com> for psarc-record@sac.sfbay.sun.com; Thu, 28 Jun 2007 12:33:30 -0700 (PDT) Date: Thu, 28 Jun 2007 12:33:33 -0700 From: John Plocher Subject: [Fwd: krb5_ldap_util command for Solaris Kerberos [PSARC/2007/368 FastTrack timeout 06/26/,2007]] Sender: John.Plocher@Sun.COM To: psarc-record@sac.sfbay.sun.com Message-id: <46840D0D.4030307@Sun.Com> MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_VxY4hgdksZrMq4hTHUfWZQ)" User-Agent: Thunderbird 1.5.0.12 (Macintosh/20070509) Status: RO Content-Length: 29377 This is a multi-part message in MIME format. --Boundary_(ID_VxY4hgdksZrMq4hTHUfWZQ) Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT -------- Original Message -------- Subject: krb5_ldap_util command for Solaris Kerberos [PSARC/2007/368 FastTrack timeout 06/26/,2007] Date: Tue, 19 Jun 2007 11:27:49 -0400 From: Wyllys Ingersoll To: PSARC-ext@sun.com CC: krb5-core@sun.com I am sponsoring the following fast-track for Will Fiveash. * The release binding is patch/micro. * The interface stability is committed. * The timer is set for 1 week (6/27/2007) - Wyllys Ingersoll --Boundary_(ID_VxY4hgdksZrMq4hTHUfWZQ) Content-type: text/plain; name=ldap_util_onepager.txt; x-mac-creator=0; x-mac-type=0 Content-transfer-encoding: 7BIT Content-disposition: inline; filename=ldap_util_onepager.txt Template Version: @(#)onepager.txt 1.29 04/11/15 SMI This information is Copyright 2007 Sun Microsystems, Inc. 1. Introduction 1.1. Project/Component Working Name: kdb5_ldap_util command for Solaris Kerberos 1.2. Name of Document Author/Supplier: Will Fiveash 1.3. Date of This Document: 07/03/04 1.4. Name of Major Document Customer(s)/Consumer(s): 1.4.1. The PAC or CPT you expect to review your project: Solaris PAC 1.4.2. The ARC(s) you expect to review your project: PSARC 1.4.3. The Director/VP who is "Sponsoring" this project: Kathy Jenks 1.4.4. The name of your business unit: Software 1.5. Email Aliases: 1.5.1. Responsible Manager: Anup.Sekhar@Sun.COM 1.5.2. Responsible Engineer: William.Fiveash@sun.com 1.5.3. Marketing Manager: Mark.Thacker@Sun.COM 1.5.4. Interest List: kerberos-interest@sun.com 2. Project Summary 2.1. Project Description: This fasttrack is about including a new utility, kdb5_ldap_util, as part of an earlier fast track: PSARC 2006/277 LDAP Backend for Kerberos KDC This utility is used to manage certain LDAP objects and a LDAP/SASL bind password file not managed by the current kadmin/kadmin.local commands. These include the krbRealmContainer object and the KrbPolicy and KrbPolicyAux objects that contain ticket policy attributes. 2.2. Risks and Assumptions: - Risk: This is a new utility from MIT and may undergo changes in its interface. 3. Business Summary 3.1. Problem Area: When Novell contributed code to MIT to enable the KDC to access Kerberos records via LDAP they provided a schema with a number of classes some of which are not managed by any of the existing utilities (kdb5_util, kadmin). These classes (krbRealmContainer, krbPolicy/krbPolicyAux) contain optional attributes that can be set via a new utility called kdb5_ldap_util. Novell decided that modifying the existing utilities like kdb5_util or kadmin was problematic because these utilities are closely oriented towards the existing Kerberos records thus they provided kdb5_ldap_util. In addition to providing a administration interface for the mentioned classes kdb5_ldap_util provides a interface to manage a hex encoded password file used by the KDC for simple SASL binds to the Directory Server. 3.2. Market/Requester: Citi Group, Shell, Clearstream, Cisco, Motorola, Sun ITOps (from Mark Thacker) 3.3. Business Justification: Kerberos is an important part of the Solaris Single-Sign-On strategy and is also used by MS Active Directory for security and is thus required for Solaris AD interoperability. Enterprise customers want tighter integration between Solaris Kerberos databases and their existing DS setups as this will simplify the database administration. This utility is needed to provide more complete administration of the optional LDAP classes that control KDC configuration. 3.4. Competitive Analysis: Our competition is IBM, HP, Microsoft, Apple and various Linux distributions. By providing a LDAP backend plugin for the KDC, Solaris Kerberos is taking a step towards integration with our DS. The kdb5_ldap_utility provides additional administration control over KDC configuration stored in LDAP objects. 3.5. Opportunity Window/Exposure: N/A 3.6. How will you know when you are done?: This project will be done when Solaris Kerberos has the ability to access (read/write) KDB records via LDAP and local Berkely db2 DB tested and documentation updated. In addition kdb5_ldap_util function will be fully tested. 4. Technical Description: 4.1. Details: This will be done by porting the MIT kdb5_ldap_util utility into ON. 4.2. Bug/RFE Number(s): 6399903 Support for Kerberos Records in LDAP Directory 4.3. In Scope: Modifications of several Kerberos utilities and daemons to support the LDAP plugin will be done as part of the port. This includes the krb5kdc, kadmin, kadmind, kdb5_util and kdb5_ldap_util. See section 4.5 Interfaces for more information. 4.4. Out of Scope: Previously I had written that KDB Administration tools beyond the currently provide kadmin and kdb5_util were out of scope. Since then I have determined that the kdb5_ldap_util is needed to manage the hex encoded password file used if the KDC is configured to do a password based SASL bind to the DS. In addition kdb5_ldap_util allows management of the object classes described in section 3.1. 4.5. Interfaces: From the man page: SYNOPSIS kdb5_ldap_util [-D user_dn [-w passwd]] [-H ldapuri] command [command_options] DESCRIPTION kdb5_ldap_util allows an administrator to manage realms, Kerberos services and ticket policies. COMMAND-LINE OPTIONS -D user_dn Specifies the Distinguished name (DN) of the user who has sufficient rights to perform the operation on the LDAP server. -H ldapuri Specifies the URI of the LDAP server. COMMANDS: create \ [-subtrees subtree_dn_list] [-sscope search_scope] [-containerref container_reference_dn] [-k mkeytype] [-m|-P password|-sf stashfilename] [-s] [-r realm] [-maxtktlife max_ticket_life] [-maxrenewlife max_renewable_ticket_life] [ticket_flags] Creates realm in directory. Options: -subtrees subtree_dn_list Specifies the list of subtrees containing the principals of a realm. The list contains the DNs of the subtree objects separated by colon(:). -sscope search_scope Specifies the scope for searching the principals under the subtree. The possible values are 1 or one (one level), 2 or sub (subtrees). -containerref container_reference_dn Specifies the DN of the container object in which the principals of a realm will be created. If the container reference is not configured for a realm, the principals will be created in the realm con- tainer. -k mkeytype Specifies the key type of the master key in the database; the default is that given in kdc.conf. -m Specifies that the master database password should be read from the TTY rather than fetched from a file on the disk. -P password Specifies the master database password. This option is not recommended. -sf stashfilename Specifies the stash file of the master database password. -s Specifies that the stash file is to be created. -maxtktlife max_ticket_life Specifies maximum ticket life for principals in this realm. -maxrenewlife max_renewable_ticket_life Specifies maximum renewable life of tickets for principals in this realm. ticket_flags Specifies the ticket flags. If this option is not specified, by default, none of the flags are set. This means all the ticket options will be allowed and no restriction will be set. The various flags are: {-|+}allow_postdated -allow_postdated prohibits principals from obtain- ing postdated tickets. (Sets the KRB5_KDB_DISALLOW_POSTDATED flag.) +allow_postdated clears this flag. {-|+}allow_forwardable -allow_forwardable prohibits principals from obtaining forwardable tickets. (Sets the KRB5_KDB_DISALLOW_FORWARDABLE flag.) +allow_forwardable clears this flag. {-|+}allow_renewable -allow_renewable prohibits principals from obtain- ing renewable tickets. (Sets the KRB5_KDB_DISALLOW_RENEWABLE flag.) +allow_renewable clears this flag. {-|+}allow_proxiable -allow_proxiable prohibits principals from obtain- ing proxiable tickets. (Sets the KRB5_KDB_DISALLOW_PROXIABLE flag.) +allow_proxiable clears this flag. {-|+}allow_dup_skey -allow_dup_skey Disables user-to-user authentica- tion for principals by prohibiting principals from obtaining a session key for another user. (Sets the KRB5_KDB_DISALLOW_DUP_SKEY flag.) +allow_dup_skey clears this flag. {-|+}requires_preauth +requires_preauth requires principals to preau- thenticate before being allowed to kinit. (Sets the KRB5_KDB_REQUIRES_PRE_AUTH flag.) - requires_preauth clears this flag. {-|+}requires_hwauth +requires_hwauth requires principals to preauthen- ticate using a hardware device before being allowed to kinit. (Sets the KRB5_KDB_REQUIRES_HW_AUTH flag.) -requires_hwauth clears this flag. {-|+}allow_svr -allow_svr prohibits the issuance of service tick- ets for principals. (Sets the KRB5_KDB_DISALLOW_SVR flag.) +allow_svr clears this flag. {-|+}allow_tgs_req -allow_tgs_req specifies that a Ticket-Granting Service (TGS) request for a service ticket for principals is not permitted. This option is use- less for most things. +allow_tgs_req clears this flag. The default is +allow_tgs_req. In effect, -allow_tgs_req sets the KRB5_KDB_DISALLOW_TGT_BASED flag on principals in the database. {-|+}allow_tix -allow_tix forbids the issuance of any tickets for principals. +allow_tix clears this flag. The default is +allow_tix. In effect, -allow_tix sets the KRB5_KDB_DISALLOW_ALL_TIX flag on principals in the database. {-|+}needchange +needchange sets a flag in attributes field to force a password change; -needchange clears it. The default is -needchange. In effect, +needchange sets the KRB5_KDB_REQUIRES_PWCHANGE flag on principals in the database. {-|+}password_changing_service +password_changing_service sets a flag in the attributes field marking principal as a password change service principal (useless for most things). -password_changing_service clears the flag. This flag intentionally has a long name. The default is -password_changing_service. In effect, +password_changing_service sets the KRB5_KDB_PWCHANGE_SERVICE flag on principals in the database. -r realm Specifies the Kerberos realm of the database; by default the realm returned by krb5_default_local_realm(3) is used. modify \ [-subtrees subtree_dn_list] [-sscope search_scope] [-containerref container_reference_dn] [-r realm] [-maxtktlife max_ticket_life] [-maxrenewlife max_renewable_ticket_life] [ticket_flags] Modifies the attributes of a realm. Options: -subtrees subtree_dn_list Specifies the list of subtrees containing the principals of a realm. The list contains the DNs of the subtree objects separated by colon(:). This list replaces the existing list. -sscope search_scope Specifies the scope for searching the principals under the subtrees. The possible values are 1 or one (one level), 2 or sub (subtrees). -containerref container_reference_dn Specifies the DN of the container object in which the principals of a realm will be created. -maxtktlife max_ticket_life Specifies maximum ticket life for principals in this realm. -maxrenewlife max_renewable_ticket_life Specifies maximum renewable life of tickets for principals in this realm. ticket_flags Specifies the ticket flags. If this option is not specified, by default, none of the flags are set. This means all the ticket options will be allowed and no restriction will be set. The various flags are: {-|+}allow_postdated -allow_postdated prohibits principals from obtain- ing postdated tickets. (Sets the KRB5_KDB_DISALLOW_POSTDATED flag.) +allow_postdated clears this flag. {-|+}allow_forwardable -allow_forwardable prohibits principals from obtaining forwardable tickets. (Sets the KRB5_KDB_DISALLOW_FORWARDABLE flag.) +allow_forwardable clears this flag. {-|+}allow_renewable -allow_renewable prohibits principals from obtain- ing renewable tickets. (Sets the KRB5_KDB_DISALLOW_RENEWABLE flag.) +allow_renewable clears this flag. {-|+}allow_proxiable -allow_proxiable prohibits principals from obtain- ing proxiable tickets. (Sets the KRB5_KDB_DISALLOW_PROXIABLE flag.) +allow_proxiable clears this flag. {-|+}allow_dup_skey -allow_dup_skey Disables user-to-user authentica- tion for principals by prohibiting principals from obtaining a session key for another user. (Sets the KRB5_KDB_DISALLOW_DUP_SKEY flag.) +allow_dup_skey clears this flag. {-|+}requires_preauth +requires_preauth requires principals to preau- thenticate before being allowed to kinit. (Sets the KRB5_KDB_REQUIRES_PRE_AUTH flag.) - requires_preauth clears this flag. {-|+}requires_hwauth +requires_hwauth requires principals to preauthen- ticate using a hardware device before being allowed to kinit. (Sets the KRB5_KDB_REQUIRES_HW_AUTH flag.) -requires_hwauth clears this flag. {-|+}allow_svr -allow_svr prohibits the issuance of service tick- ets for principals. (Sets the KRB5_KDB_DISALLOW_SVR flag.) +allow_svr clears this flag. {-|+}allow_tgs_req -allow_tgs_req specifies that a Ticket-Granting Service (TGS) request for a service ticket for principals is not permitted. This option is use- less for most things. +allow_tgs_req clears this flag. The default is +allow_tgs_req. In effect, -allow_tgs_req sets the KRB5_KDB_DISALLOW_TGT_BASED flag on principals in the database. {-|+}allow_tix -allow_tix forbids the issuance of any tickets for principals. +allow_tix clears this flag. The default is +allow_tix. In effect, -allow_tix sets the KRB5_KDB_DISALLOW_ALL_TIX flag on principals in the database. {-|+}needchange +needchange sets a flag in attributes field to force a password change; -needchange clears it. The default is -needchange. In effect, +needchange sets the KRB5_KDB_REQUIRES_PWCHANGE flag on principals in the database. {-|+}password_changing_service +password_changing_service sets a flag in the attributes field marking principal as a password change service principal (useless for most things). -password_changing_service clears the flag. This flag intentionally has a long name. The default is -password_changing_service. In effect, +password_changing_service sets the KRB5_KDB_PWCHANGE_SERVICE flag on principals in the database. -r realm Specifies the Kerberos realm of the database; by default the realm returned by krb5_default_local_realm(3) is used. view [-r realm] Displays the attributes of a realm. Options: -r realm Specifies the Kerberos realm of the database; by default the realm returned by krb5_default_local_realm(3) is used. destroy [-f] [-r realm] Destroys an existing realm. Options: -f If specified, will not prompt the user for confir- mation. -r realm Specifies the Kerberos realm of the database; by default the realm returned by krb5_default_local_realm(3) is used. list Lists the name of realms. stashsrvpw [-f filename] servicedn Allows an administrator to store the password for ser- vice object in a file so that KDC and Administration server can use it to authenticate to the LDAP server. Options: -f filename Specifies the complete path of the service pass- word file. By default, /var/krb5/service_passwd is used. servicedn Specifies Distinguished name (DN) of the service object whose password is to be stored in file. create_policy \ [-r realm] [-maxtktlife max_ticket_life] [-maxrenewlife max_renewable_ticket_life] [ticket_flags] policy_name Creates a ticket policy in directory. Options: -r realm Specifies the Kerberos realm of the database; by default the realm returned by krb5_default_local_realm(3) is used. -maxtktlife max_ticket_life Specifies maximum ticket life for principals. -maxrenewlife max_renewable_ticket_life Specifies maximum renewable life of tickets for principals. ticket_flags Specifies the ticket flags. If this option is not specified, by default, none of the flags are set. This means all the ticket options will be allowed and no restriction will be set. The various flags are: {-|+}allow_postdated -allow_postdated prohibits principals from obtain- ing postdated tickets. (Sets the KRB5_KDB_DISALLOW_POSTDATED flag.) +allow_postdated clears this flag. {-|+}allow_forwardable -allow_forwardable prohibits principals from obtaining forwardable tickets. (Sets the KRB5_KDB_DISALLOW_FORWARDABLE flag.) +allow_forwardable clears this flag. {-|+}allow_renewable -allow_renewable prohibits principals from obtain- ing renewable tickets. (Sets the KRB5_KDB_DISALLOW_RENEWABLE flag.) +allow_renewable clears this flag. {-|+}allow_proxiable -allow_proxiable prohibits principals from obtain- ing proxiable tickets. (Sets the KRB5_KDB_DISALLOW_PROXIABLE flag.) +allow_proxiable clears this flag. {-|+}allow_dup_skey -allow_dup_skey Disables user-to-user authentica- tion for principals by prohibiting principals from obtaining a session key for another user. (Sets the KRB5_KDB_DISALLOW_DUP_SKEY flag.) +allow_dup_skey clears this flag. {-|+}requires_preauth +requires_preauth requires principals to preau- thenticate before being allowed to kinit. (Sets the KRB5_KDB_REQUIRES_PRE_AUTH flag.) - requires_preauth clears this flag. {-|+}requires_hwauth +requires_hwauth requires principals to preauthen- ticate using a hardware device before being allowed to kinit. (Sets the KRB5_KDB_REQUIRES_HW_AUTH flag.) -requires_hwauth clears this flag. {-|+}allow_svr -allow_svr prohibits the issuance of service tick- ets for principals. (Sets the KRB5_KDB_DISALLOW_SVR flag.) +allow_svr clears this flag. {-|+}allow_tgs_req -allow_tgs_req specifies that a Ticket-Granting Service (TGS) request for a service ticket for principals is not permitted. This option is use- less for most things. +allow_tgs_req clears this flag. The default is +allow_tgs_req. In effect, -allow_tgs_req sets the KRB5_KDB_DISALLOW_TGT_BASED flag on principals in the database. {-|+}allow_tix -allow_tix forbids the issuance of any tickets for principals. +allow_tix clears this flag. The default is +allow_tix. In effect, -allow_tix sets the KRB5_KDB_DISALLOW_ALL_TIX flag on principals in the database. {-|+}needchange +needchange sets a flag in attributes field to force a password change; -needchange clears it. The default is -needchange. In effect, +needchange sets the KRB5_KDB_REQUIRES_PWCHANGE flag on principals in the database. {-|+}password_changing_service +password_changing_service sets a flag in the attributes field marking principal as a password change service principal (useless for most things). -password_changing_service clears the flag. This flag intentionally has a long name. The default is -password_changing_service. In effect, +password_changing_service sets the KRB5_KDB_PWCHANGE_SERVICE flag on principals in the database. policy_name Specifies the name of the ticket policy. modify_policy \ [-r realm] [-maxtktlife max_ticket_life] [-maxrenewlife max_renewable_ticket_life] [ticket_flags] policy_name Modifies the attributes of a ticket policy. Options are same as create_policy. -r realm Specifies the Kerberos realm of the database; by default the realm returned by krb5_default_local_realm(3) is used. view_policy [-r realm] policy_name Displays the attributes of a ticket policy. Options: policy_name Specifies the name of the ticket policy. destroy_policy [-r realm] [-force] policy_name Destroys an existing ticket policy. Options: -r realm Specifies the Kerberos realm of the database; by default the realm returned by krb5_default_local_realm(3) is used. -force Forces the deletion of the policy object. If not specified, will be prompted for confirmation while deleting the policy. Enter yes to confirm the deletion. policy_name Specifies the name of the ticket policy. list_policy [-r realm] Lists the ticket policies in realm if specified or in the default realm. Options: -r realm Specifies the Kerberos realm of the database; by default the realm returned by krb5_default_local_realm(3) is used. Stability Level: Committed 4.6. Doc Impact: There will be a new man page for kdb5_ldap_util (see above). There will also be impact to the Solaris sysadmin guide to describe how to use the utility. 4.7. Admin/Config Impact: In addition to the changes listed in the one pager for the PSARC 2006/277 case there will use of the kdb5_ldap_util to manage . 4.8. HA Impact: No additional HA impact. 4.9. I18N/L10N Impact: There are about 252 new messages. 4.10. Packaging & Delivery: In addition to the packaging changes described in the 2006/277 one pager usr/sbin/kdb5_ldap_util will be added to the SUNWkdcu package. 4.11. Security Impact: kdb5_ldap_util provides the option to create/manage a new file that contains hex encoded passwords for the LDAP bind DN's for KDC, kadmind and kpasswd. The security of this file will rely on filesystem permissions that allow only root to read/write this file. This is similar to the currently supported KDC master key stash file. The default location of this file is: /var/krb5/service_passwd In addition kdb5_ldap_util supports a "create -P " command line. While this violates Solaris policy on allowing clear-text passwords on command lines, there is a precedent set by the existing kdb5_util which supports a similar "create -P " command line. Solaris Kerberos has generally tried to stay consistent with MIT in regards to interfaces which is why this -P flag is included in this fast track. 4.12. Dependencies: The dependencies are the same as for the PSARC 2006/277 case. 5. Reference Documents: Solaris Kerberos home page: http://kerberos.eng/ 6. Resources and Schedule: See one pager for PSARC 2006/277 LDAP Backend for Kerberos KDC. 7. Prototype Availability: 7.1. Prototype Availability: N/A 7.2. Prototype Cost: N/A --Boundary_(ID_VxY4hgdksZrMq4hTHUfWZQ)--