./security/mit-krb5, MIT Kerberos 5 authentication system

[ CVSweb ] [ Homepage ] [ RSS ] [ Required by ] [ Add to tracker ]


Branch: CURRENT, Version: 1.21.2, Package name: mit-krb5-1.21.2, Maintainer: tez

Kerberos V5 is an authentication system developed at MIT. It is a network
authentication protocol designed to provide strong authentication for
client/server applications by using secret-key cryptography. (Kerberos
5 is discussed in RFC 1510.)

This package provides Kerberos and GSSAPI (Generic Security Services
Application Programming Interface) development headers and libraries.
It also includes Kerberos ticket and principal tools.

N.B. Kerberized r-services, telnet and ftp services are now found in
the security/mit-krb5-appl package.


Required to run:
[security/openssl] [databases/lmdb]

Required to build:
[pkgtools/cwrappers]

Master sites:

Filesize: 8420.423 KB

Version history: (Expand)


CVS history: (Expand)


   2024-01-16 23:16:35 by Roland Illig | Files touched by this commit (1)
Log message:
security/mit-krb5: remove unknown configure option
   2024-01-13 21:10:07 by Taylor R Campbell | Files touched by this commit (2)
Log message:
security/heimdal, security/mit-krb5: Do krb5-config in cross-destdir.

Although this is an executable program, it's a very simple shell
script which can be run in the build environment to describe the
target environment.  So qualify paths to it by ${_CROSS_DESTDIR:U},
where it lives during cross-builds.

No change to native builds because ${_CROSS_DESTDIR:U} is empty in
them.
   2024-01-06 00:46:29 by Adam Ciarcinski | Files touched by this commit (8) | Package updated
Log message:
mit-krb5: updated to 1.21.2

Major changes in 1.21.2 (2023-08-14)

Fix double-free in KDC TGS processing [CVE-2023-39975].

Major changes in 1.21.1 (2023-07-10)

Fix potential uninitialized pointer free in kadm5 XDR parsing [CVE-2023-36054].

Major changes in 1.21 (2023-06-05)

User experience
Added a credential cache type providing compatibility with the macOS 11 native \ 
credential cache.
Developer experience
libkadm5 will use the provided krb5_context object to read configuration values, \ 
instead of creating its own.
Added an interface to retrieve the ticket session key from a GSS context.
Protocol evolution
The KDC will no longer issue tickets with RC4 or triple-DES session keys unless \ 
explicitly configured with the new allow_rc4 or allow_des3 variables \ 
respectively.
The KDC will assume that all services can handle aes256-sha1 session keys unless \ 
the service principal has a session_enctypes string attribute.
Support for PAC full KDC checksums has been added to mitigate an S4U2Proxy \ 
privilege escalation attack.
The PKINIT client will advertise a more modern set of supported CMS algorithms.
Code quality
Removed unused code in libkrb5, libkrb5support, and the PKINIT module.
Modernized the KDC code for processing TGS requests, the code for encrypting and \ 
decrypting key data, the PAC handling code, and the GSS library packet parsing \ 
and composition code.
Improved the test framework's detection of memory errors in daemon processes \ 
when used with asan.
   2023-10-25 00:11:51 by Thomas Klausner | Files touched by this commit (2298)
Log message:
*: bump for openssl 3
   2022-07-29 22:22:44 by Jonathan Perkin | Files touched by this commit (8)
Log message:
mit-krb5: Update to 1.19.3.

Major changes in 1.19.3 (2022-03-11)
------------------------------------

This is a bug fix release.

* Fix a denial of service attack against the KDC [CVE-2021-37750].

krb5-1.19.3 changes by ticket ID
--------------------------------

9008    Fix KDC null deref on TGS inner body null server
9023    Fix conformance issue in GSSAPI tests

Major changes in 1.19.2 (2021-07-22)
------------------------------------

This is a bug fix release.

* Fix a denial of service attack against the KDC encrypted challenge
  code [CVE-2021-36222].

* Fix a memory leak when gss_inquire_cred() is called without a
  credential handle.

krb5-1.19.2 changes by ticket ID
--------------------------------

8989    Fix typo in enctypes.rst
8992    Avoid rand() in aes-gen test program
9005    Fix argument type errors on Windows
9006    doc build fails with Sphinx 4.0.2
9007    Fix KDC null deref on bad encrypted challenge
9014    Using locking in MEMORY krb5_cc_get_principal()
9015    Fix use-after-free during krad remote_shutdown()
9016    Memory leak in krb5_gss_inquire_cred

Major changes in 1.19.1 (2021-02-18)
------------------------------------

This is a bug fix release.

* Fix a linking issue with Samba.

* Better support multiple pkinit_identities values by checking whether
  certificates can be loaded for each value.

krb5-1.19.1 changes by ticket ID
--------------------------------

8984    Load certs when checking pkinit_identities values
8985    Restore krb5_set_default_tgs_ktypes()
8987    Synchronize command-line option documentation

Major changes in 1.19 (2021-02-01)
----------------------------------

Administrator experience:

* When a client keytab is present, the GSSAPI krb5 mech will refresh
  credentials even if the current credentials were acquired manually.

* It is now harder to accidentally delete the K/M entry from a KDB.

Developer experience:

* gss_acquire_cred_from() now supports the "password" and \ 
"verify"
  options, allowing credentials to be acquired via password and
  verified using a keytab key.

* When an application accepts a GSS security context, the new
  GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
  both provided matching channel bindings.

* Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self
  requests to identify the desired client principal by certificate.

* PKINIT certauth modules can now cause the hw-authent flag to be set
  in issued tickets.

* The krb5_init_creds_step() API will now issue the same password
  expiration warnings as krb5_get_init_creds_password().

Protocol evolution:

* Added client and KDC support for Microsoft's Resource-Based
  Constrained Delegation, which allows cross-realm S4U2Proxy requests.
  A third-party database module is required for KDC support.

* kadmin/admin is now the preferred server principal name for kadmin
  connections, and the host-based form is no longer created by
  default.  The client will still try the host-based form as a
  fallback.

* Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
  extension, which causes channel bindings to be required for the
  initiator if the acceptor provided them.  The client will send this
  option if the client_aware_gss_bindings profile option is set.

User experience:

* kinit will now issue a warning if the des3-cbc-sha1 encryption type
  is used in the reply.  This encryption type will be deprecated and
  removed in future releases.

* Added kvno flags --out-cache, --no-store, and --cached-only
  (inspired by Heimdal's kgetcred).

krb5-1.19 changes by ticket ID
------------------------------

7976    Client keytab does not refresh manually obtained ccaches
8332    Referral and cross-realm TGS requests fail with anonymous cache
8871    Zero length fields when freeing object contents
8879    Allow certauth modules to set hw-authent flag
8885    PKINIT calls responder twice
8890    Add finalization safety check to com_err
8893    Do expiration warnings for all init_creds APIs
8897    Pass gss_localname() through SPNEGO
8899    Implement GSS_C_CHANNEL_BOUND_FLAG
8900    Implement KERB_AP_OPTIONS_CBT (server side)
8901    Stop reporting krb5 mech from IAKERB
8902    Omit KDC indicator check for S4U2Self requests
8904    Add KRB5_PRINCIPAL_PARSE_NO_DEF_REALM flag
8907    Pass channel bindings through SPNEGO
8909    Return GSS_S_NO_CRED from krb5 gss_acquire_cred
8910    Building with --enable-static fails when Yasm is available
8911    Default dns_canonicalize_hostname to "fallback"
8912    Omit PA_FOR_USER if we can't compute its checksum
8913    Deleting master key principal entry shouldn't be possible
8914    Invalid negative record length in keytab file
8915    Try to find <target>-ar when cross compiling
8917    Add three kvno options from Heimdal kgetcred
8919    Interop with Heimdal KDC for S4U2Self requests
8920    Fix KDC choice to send encrypted S4U_X509_USER
8921    Use the term "primary KDC" in source and docs
8922    Trace plugin module loading errors
8923    Add GSS_KRB5_NT_X509_CERT name type
8927    getdate.y %type warnings with bison 3.5
8928    Fix three configure tests for Xcode 12
8929    Ignore bad enctypes in krb5_string_to_keysalts()
8930    Expand dns_canonicalize_host=fallback support
8931    Cache S4U2Proxy requests by second ticket
8932    Do proper length decoding in SPNEGO gss_get_oid()
8934    Try kadmin/admin first in libkadm5clnt
8935    Don't create hostbased principals in new KDBs
8937    Fix Leash console option
8940    Remove Leash import functionality
8942    Fix KRB5_GC_CACHED for S4U2Self requests
8943    Allow KDC to canonicalize realm in TGS client
8944    Harmonize macOS pack declarations with Heimdal
8946    Improve KDC alias checking for S4U requests
8947    Warn when des3-cbc-sha1 is used for initial auth
8948    Update SRV record documentation
8950    Document enctype migration
8951    Allow aliases when matching U2U second ticket
8952    Fix doc issues with newer Doxygen and Sphinx
8953    Move more KDC checks to validate_tgs_request()
8954    Update Gladman AES code to a version with a clearer license
8957    Use PKG_CHECK_MODULES for system library com_err
8961    Fix gss_acquire_cred_from() IAKERB handling
8962    Add password option to cred store
8963    Add verify option to cred store
8964    Add GSS credential store documentation
8965    Install shared libraries as executable
8966    Improve duplicate checking in gss_add_cred()
8967    Continue on KRB5_FCC_NOFILE in KCM cache iteration
8969    Update kvno(1) synopsis with missing options
8971    Implement fallback for GSS acceptor names
8973    Revert dns_canonicalize_hostname default to true
8975    Incorrect runstatedir substitution affecting "make install"

Major changes in 1.18.5 (2022-03-11)
------------------------------------

This is a bug fix release.

* Fix a denial of service attack against the KDC [CVE-2021-37750].

krb5-1.18.5 changes by ticket ID
--------------------------------

9008    Fix KDC null deref on TGS inner body null server
   2022-06-28 13:38:00 by Thomas Klausner | Files touched by this commit (3952)
Log message:
*: recursive bump for perl 5.36
   2021-10-26 13:18:07 by Nia Alarie | Files touched by this commit (605)
Log message:
security: Replace RMD160 checksums with BLAKE2s checksums

All checksums have been double-checked against existing RMD160 and
SHA512 hashes

Unfetchable distfiles (fetched conditionally?):
./security/cyrus-sasl/distinfo \ 
cyrus-sasl-dedad73e5e7a75d01a5f3d5a6702ab8ccd2ff40d.patch.v2
   2021-10-07 16:54:50 by Nia Alarie | Files touched by this commit (606)
Log message:
security: Remove SHA1 hashes for distfiles