f



question about MIT Kerberos KDC processing PROXY KDC requests

Hello,

I understand that proxiable/proxy tickets are rarely used and the
corresponding code in the MIT Kerberos implementation is not very well
tested.  However, I found two possibly buggy places in the KDC code,
so I think this is worth asking about.

I used the MIT Kerberos distribution and was able to make proxiable/
proxy tickets work, but had two make two changes in the KDC source
code.  I would like to ask if these are really bugs or not.  We use
the MIT Kerberos 1.6.3 release.  Both suspicious places are in kdc/
kdc_util.c, validate_tgs_request():

1. line 1144:

if (request->kdc_options & NO_TGT_OPTION) {
    if (!krb5_principal_compare(kdc_context, ticket->server,
request_server)) {
        *status = "SERVER DIDN'T MATCH TICKET FOR RENEW/FORWARD/ETC";
        return(KDC_ERR_SERVER_NOMATCH);
    }
}

NOT_TGT_OPTION is defined as:

#define NO_TGT_OPTION (KDC_OPT_FORWARDED | KDC_OPT_PROXY |
KDC_OPT_RENEW | KDC_OPT_VALIDATE)

The KDC returns an error here if the server principal in the ticket
does not match the one in the KDC request.  I can see how this check
is required for the "forwarded", "renew" and "validate" KDC requests.
However, for a proxy ticket request, it seems that:
 - the ticket must be a TGT with ticket->server = krbtgt/R1@R2, for
some R1 and R2
 - the KDC request must have a server principal request->server = the
target application server's Kerberos principal

Should the #define NO_TGT_OPTION really include KDC_OPT_PROXY?


2. line 1236:

if (isflagset(request->kdc_options, KDC_OPT_PROXY) &&
    (!request->server->data ||
      request->server->data[0].length != KRB5_TGS_NAME_SIZE ||
      memcmp(request->server->data[0].data, KRB5_TGS_NAME,
KRB5_TGS_NAME_SIZE))) {

    *status = "CAN'T PROXY TGT";
    return KDC_ERR_BAD_OPTION;
}

KRB5_TGS_NAME is #define-d as "krbtgt"
KRB5_TGS_NAME_SIZE is #define-d as 6

Isn't the boolean logic inverted here?  We should return an error if
KDC_OPT_PROXY is set and request->server->data[0] is "krbtgt", which
would indicate a request for a TGT.  Is that correct?

Best Regards,
Peter Djalaliev
0
2/3/2009 10:32:59 PM
comp.protocols.kerberos 5541 articles. 1 followers. jwinius (31) is leader. Post Follow

0 Replies
572 Views

Similar Articles

[PageSpeed] 34

Reply:

Similar Artilces:

MIT Kerberos KDC & W2K Client: Changing expired password issueMIT Kerberos KDC & W2K Client: Changing expired password issue
Hi, I also experienced the same problem as William G.Zereneh (http://mailman.mit.edu/pipermail/kerberos/2004-May/005341.html). I'm able to change the password using ctrl-alt-del, but when the password is expired and windows asks me to change the password, I encountered "Domain MIT.REALM.COM is not available" error. As I sniff the packet, it noticed that it sent a CLDAP query message with filter: (&(DnsDomain = MIT.REALM.COM)(Host = myhostname)(NtVer=\006) which is returned NULL by my _ldap._tcp.dc._msdcs.REALM.MIT.COM How to resolve this problem ? maybe there's a missing entry in my DNS ? Is it mandatory for the MIT Kerberos KDC (I installed it on RedHat Linux) to have an LDAP service to resolve the CLDAP request ? and can LDAP actually entertains CLDAP request since LDAP is using TCP while CLDAP is using UDP ? Can I resolve the CLDAP request using Windows 2000 server instead ? Any ideas will be very appreciated Regards from newbie, lara ===== ------------------------------------------------------------------------------------ La vie, voyez-vous, ca n'est jamais si bon ni si mauvais qu'on croit - Guy de Maupassant - ------------------------------------------------------------------------------------ __________________________________ Do you Yahoo!? Friends. Fun. Try the all-new Yahoo! Messenger. http://messenger.yahoo.com/ ____________________________________...

Solaris 10 Kerberos KDC ignores settings in kdc.conf
I've configured Sun's Kerberos on a solaris 10 box. Everything seams to work straight, creating database, creating principles etc.. But the KDC ignores quite a few options in kdc.conf file, including: max_life = 12h 0m 0s max_renewable_life = 7d 0h 0m 0s default_principal_flags = +forwardable Not matter how I set these options, I _always_ get these for principles: Maximum ticket life: 24855 days 03:14:07 Maximum renewable life: 24855 days 03:14:07 Attributes: It seams Sun has some defaults set and are unchangeable. The gkadmin GUI utility shows the two life period exactly as the above number. If you change and save the changes, next time you run gkadmin, the old values come back. Has anyone seen the same behavior? And how to fix it? MIT Kerberos works fine, but to utilize Sun's PAM migration module for our existing user base (900 users), I need to run Sun's at least when we are migrating users. Applying Sun's Kerberos patch 120469-07 did not fix the problem. TIA, Qing Chang ...

Help on Unix kerberos client->win2k3 kerberos KDC
Hello, I am a newbie to kerberos authentication, and what I am trying to do is to use a Unix ldap client authenticate to the win2k3 server, and add a user to it. The way I tried to do is by following MIT's tutorial and sample code under www.mit.edu/afs/athena/astaff/project/ ldap/AD99/kerberossamp.txt. and I configured the Unix machine based on Microsoft tutorial http://www.microsoft.com/windows2000/techinfo/planning/security/kerbsteps.asp =========> I can successfully import a tgt from win2k3 KDC server by running kinit, here is the result: $ kdestroy $ kinitPassword for mw...

MIT Kerberos clients and Windows KDC
Hi all, I am trying to make an embedded device part of the windows domain and use windows DC as KDC for my embedded divice. Embedded device has MIT Kerberos. I am using GSS API . * How can we get the TGT for the server programatically ( transperently ) with out user intervention ? * If the device restarts, then do I need to store the TGT in persistent memory ? * If I am not wrong, microsoft adds the PAC data which no limitation of size. I have memory constraints. Is it required to store the TGT in non volatile memory ? I need this info since I am trying to find in case if the embedded device reboots ,then do I need to store the TGT in non volatile memory or I can get it again after the device comes up. * Assuming that a client is accessing services on embedded device via Kerberos and there is already a successful kerberos session is established. If at this point, if the embedded device reboots and the device gets TGT again, will it alter the communication in any way ? Could anybody please respond to these queries? Regards in article 1132304089.372626.30620@g49g2000cwa.googlegroups.com, sandypossible@gmail.com at sandypossible@gmail.com wrote on 11/18/05 2:54 AM: > Hi all, > > I am trying to make an embedded device part of the windows domain and > use windows DC as KDC for my embedded divice. Embedded device has MIT > Kerberos. I am using GSS API . > > * How can we get the TGT for the server programatically ( transperently > ) with out u...

Kerberos KDC
Hello All, I am trying to set up a Kerberos 5 KDC on my servers. I run Windows IIS 6.0 and our management does not want to use Kerberos through AD. I was wondering if anyone could help me on where to start. Thanks in advance ...

MIT Kerberos interoperability with Windows KDC?
Hi All, Are there any significant interoperability issues between MIT Kerberos runtime library and Microsoft Windows (2000, XP, and 2003 Server) KDC? Is the conversion of Microsoft KDC ticket to MIT Kerberos standard ticket (known as the process of ms2mit) done transparently in MIT Kerberos runtime library? Or, is there an API which can be called by applications for doing ms2mit? I am new to this list and the above questions may have been asked before. Pointing to some existing FAQ or resources will also be appreciated. Thanks. -- Kevin __________________________________ Do you Yahoo!...

are referrals implemented in the MIT Kerberos KDC?
Hello, I saw some messages on this mailing from 2005 and last year on this topic, but I wanted to check what the current status of this is. Does the MIT Kerberos KDC currently implement client or server referrals, as per Internet draft http://tools.ietf.org/html/draft-ietf-krb-wg-kerberos-referrals-11 ? I can see that the MIT Kerberos client-side library implements referrals (at least server referrals) by setting hthe "canonicalize" bit in KDC requests. However, I can't see any code in the Kerberos KDC source code that checks this bit and canonicalizes the name. I am using the MIT Kerberos 1.6.3. release. The release notes say "Partial client implementation to handle server name referrals" Can you please shed a little light on this or point me to something that explains this? Thank you. Best Regards, Peter Djalaliev ...

Problem with MS Kerberos KDC and MIT KRB5
Hi, I have a KDC Windows 2000 and a Linux Server (RH 7.3 with krb5-1.3.1). I can authenticate with kinit without problem, but if I type a incorrect password the KDC w2000 counts two attemps. The problem is that KDC lock the account after five attemps ... When I set "Don't require preauthentication" in KDC only counts one attempts, but the accounts never locks. Any ideas? Thanks... -- Diego Woitasen www.lanux.linux.org.ar ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos >>>>> "Diego" == Diego Woitasen (Lanux) <diegows@linux.org.ar> writes: Diego> Hi, I have a KDC Windows 2000 and a Linux Server (RH 7.3 Diego> with krb5-1.3.1). I can authenticate with kinit without Diego> problem, but if I type a incorrect password the KDC w2000 Diego> counts two attemps. The problem is that KDC lock the Diego> account after five attemps ... This is ticket #1692 in our bug database, resolved in krb5 1.3.2. ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos ...

MS Exchange Kerberos Login to MIT KDC
Hi, With reference to the following posting: http://www.mail-archive.com/kerberos@mit.edu/msg06133.html Is there any follow-up information whether it is possible for users that do not belong to Windows domain (like those belong to workgroup) to logon to exchange server using OWA with their accounts in MIT KDC ? Thanks, lara ------------------------------------------------------------------------------------ La vie, voyez-vous, ca n'est jamais si bon ni si mauvais qu'on croit - Guy de Maupassant - ------------------------------------------------------------------------------------ --------------------------------- Do you Yahoo!? Yahoo! Mail is new and improved - Check it out! ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos >>>>> "Lara" == Lara Adianto <m1r4cle_26@yahoo.com> writes: Lara> Hi, With reference to the following posting: Lara> http://www.mail-archive.com/kerberos@mit.edu/msg06133.html Lara> Is there any follow-up information whether it is possible Lara> for users that do not belong to Windows domain (like those Lara> belong to workgroup) to logon to exchange server using OWA Lara> with their accounts in MIT KDC ? They could probably do so if you use the Outlook client and you have the Umich cross-realm ...

Problems with windows 2003 KDC and MIT kerberos
I have been having problems with getting a keytab file on a windows 2000 client running the MIT Kerberos utilities to interface properly with a windows 2003 KDC. I had the same client working correctly when the KDC was a windows 2000 server. The command "kinit rdop@INFRASTOR.US" works correctly but when I attempt to use "kinit -k" I get the following error message kinit(v5): Cannot find KDC for requested realm while getting initial credentials My krb5.ini file is as follows [libdefaults] ticket_lifetime = 600 default_realm = INFRASTOR.US default_keytab_name = C:/WINNT/krb5.keytab default_etypes = des-cbc-crc default_etypes_des = des-cbc-crc [realms] INFRASTOR.US = { kdc = 192.168.0.3 admin_server = 192.168.0.3 } [domain_realm] .infrastor.us = INFRASTOR.US infrastor.us = INFRASTOR.US "klist -k -t -K" gives the following results. Keytab name: FILE:C:/WINNT/krb5.keytab KVNO Timestamp Principal ---- ----------------- ---------------------------------------- 3 07/28/04 17:52:06 rdop@INFRASTOR.US (0x158cefb5d56d5eab) This problem is frustrating because I had the system working correctly prior to upgrading the KDC to a windows 2003 machine. I need some suggestions on where to look next. kdkirmse wrote: > > I have been having problems with getting a keytab file on a windows > 2000 client running the MIT Kerberos utilities to interface properly > with a windows 2003 KDC. I had the same client working corr...

RE: MIT Kerberos and Solaris 10 Kerberos
Wohoo! I read the man page for rlogin, and it is both the old rlogin, and the new (or something like that). Seems that you just have to give it the correct switches, and it Kerberizes the command. So, I did: rlogin -AF <sol8server> and it works! Thank you to Wyllys for all of your help. Now I'm going to try installing from scratch, and make sure I do the build properly. One question left for Wyllys before I do, though. Since ksu doesn't exist in the Solaris SEAM product, is our only option su? Rainer ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos Heilke, Rainer wrote: > Wohoo! > > I read the man page for rlogin, and it is both the old rlogin, and the > new (or something like that). Seems that you just have to give it the > correct switches, and it Kerberizes the command. So, I did: > > rlogin -AF <sol8server> > > and it works! > Excellent! > Thank you to Wyllys for all of your help. No problem, glad I could help. > > Now I'm going to try installing from scratch, and make sure I do the > build properly. > > One question left for Wyllys before I do, though. Since ksu doesn't > exist in the Solaris SEAM product, is our only option su? possibly 'su' with pam_krb5 for the authentication. Its not quite the same as 'ksu', though. -Wyllys ______________________________...

Solaris 10 Kerberos KDC ignores settings in /etc/krb5/kdc.conf
Greeting, sorry if I sent this in twice. I've configured Sun's Kerberos on a solaris 10 box. Everything seams to work straight, creating database, creating principles etc.. But the KDC ignores quite a few options in kdc.conf file, including: max_life = 12h 0m 0s max_renewable_life = 7d 0h 0m 0s default_principal_flags = +forwardable Not matter how I set these options, I _always_ get these for principles: Maximum ticket life: 24855 days 03:14:07 Maximum renewable life: 24855 days 03:14:07 Attributes: It seams Sun has some defaults set and are unchangeable. The gkadmin GUI utility shows the two life period exactly as the above number. If you change and save the changes, next time you run gkadmin, the old values come back. Has anyone seen the same behavior? And how to fix it? MIT Kerberos works fine, but to utilize Sun's PAM migration module for our existing user base (900 users), I need to run Sun's at least when we are migrating users. Applying Sun's Kerberos patch 120469-07 did not fix the problem. TIA, Qing Chang ...

MIT Kerberos or Heimdal Kerberos?
Hi, How do I know the server install in the system is MIT Kerberos or Heimdal? I m using FreeBSD 5.2.1 Thanks sam ...

RE: MIT Kerberos and Solaris 10 Kerberos
<laugh> Yup, I learned (the hard way!) to always stay logged in to a console session as root. R > Make sure you have a root window open before testing PAM. I > stumbled on > this when I tried to su and my test pam exit failed! ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos ...

RE: MIT Kerberos and Solaris 10 Kerberos
> possibly 'su' with pam_krb5 for the authentication. Its not quite > the same as 'ksu', though. Douglas says the same. The su man page indicates something about this, but not a lot of details there. I'll look into this further. As far as a co-worker is concerned (and in our environment, I can see his point), this would be a show stopper. We use ksu for all sorts of things, including giving DBA's access to Oracle ID's. Thanks again for all of the help. I'll go through the su and pam.conf man pages, and see if I can figure it out. Rainer ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos Heilke, Rainer wrote: >>possibly 'su' with pam_krb5 for the authentication. Its not quite >>the same as 'ksu', though. > > > Douglas says the same. The su man page indicates something about this, > but not a lot of details there. I'll look into this further. As far as a > co-worker is concerned (and in our environment, I can see his point), > this would be a show stopper. We use ksu for all sorts of things, > including giving DBA's access to Oracle ID's. > > Thanks again for all of the help. I'll go through the su and pam.conf > man pages, and see if I can figure it out. Make sure you have a root window open before testing PAM. I stumbled on this when I tried to su and my t...

MIT Kerberos: Cannot resolve network address for KDC in realm
Hi: I've been having a hard time getting MIT Kerberos up and running on solaris 10. The latest of my problems is this error when i run kinit from the KDC. dsldap01$ /krb5/bin/kinit rob/admin@alezeo.com kinit(v5): Cannot resolve network address for KDC in realm alezeo.com while getting initial credentials This sounds like a DNS problem, but I don't think it is. dsldap01$ host -t A dsldap01.alezeo.com dsldap01.alezeo.com has address 10.93.120.72 Also in my hosts file: 127.0.0.1 localhost 10.93.120.72 dsldap01.alezeo.com dsldap01 loghost Here is my krb5.conf ============= [libdefaults] dns_lookup_realm = false default_realm = ALEZEO.COM ticket_lifetime = 600 kdc_req_checksum_type = 2 checksum_type = 2 ccache_type = 1 default_tkt_enctypes = des-cbc-crc default_tgs_enctypes = des-cbc-crc [kdc] profile = /krb5/var/krb5kdc/kdc.conf [logging] default = FILE:/var/krb5/kdc.log kdc = FILE:/var/krb5/kdc.log admin_server = FILE:/var/krb5/adm.log [realms] ALEZEO.COM = { kdc = dsldap01.alezeo.com:88 admin_server = dsldap01.alezeo.com:749 default_domain = alezeo.com } [domain_realm] .alezeo.com = ALEZEO.COM alezeo.com = ALEZEO.COM [login] krb4_convert = 0 Here is my kdc.conf ============ [kdcdefaults] kdc_ports = 88 [realms] alezeo.com = { ...

Regarding KDC proxy test with Windows Server 2012 KDC proxy
Hi, I am trying Kerberos 5-1.13.1 on Ubutu to test KDC proxy feature. I made Windows Server 2012 AD as a KDC proxy. When I do KINIT from Linux client to Windows Server 2012 KDC proxy. I can see from wireshark that client initiated a SSL connection, client hello and server hello is successful, then I see some application data is send to KDC proxy server. after this server closed TCP connection. there is no way to debug it further. Anyone tested Linux KDC proxy client with Windows Server 2012 KDC Proxy? Am I trying something which is possible? Regards, Manish -- It is ...

samba+kerberos "cannot resolve network address for KDC in requested realm"
Hi, i'm quite new on kerberos and samba so i hope my question is not so stupid and i hope somebody could help me. I'm trying to join a linux machine (3.0.14a-Debian) to a W2K3 domain a member . I would like to have ads security on it but i dont know why i get this message "cannot resolve network address for KDC in requested realm" when i try "net ads join -U myuser%mypassword". Maybe i did not give u enough information to know what's the problem. Thank's in advance --------------------------------- LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y m�viles desde 1 c�ntimo por minuto. http://es.voice.yahoo.com ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos ...

Login to XP workstation in WIndows Server 2003 2k3 AD domain with MIT kerberos KDC
I am new to Kerberos and I probably have the terminiology wrong so I apologize right off. We are trying to build an environment where students are allowed to log into a Windows XP desktop workstation that is part of a Windows Server 2003 (we could use win2k3 or win2000 if need be...) Active Directory domain, but we would like them to authenticate to an MIT Kerberos KDC through a trust arrangement. We don't want the MIT Kerberos KDC to have to know and trust each individual workstation, we want it to only know about the Windows Server 2003 domain controller. In other words I don't want to point 100 XP workstations at the KDC for authentication, I want them to just sign into the AD domain but get authenticated by the fact that they have a valid account in the MIT kerberos KDC. Is this even possible? TIA tj > Active Directory domain, but we would like them to authenticate to an MIT > Kerberos KDC through a trust arrangement. We don't want the MIT > Kerberos KDC to have to know and trust each individual workstation, we > want it to only know about the Windows Server 2003 domain controller. > In other words I don't want to point 100 XP workstations at the KDC > for authentication, I want them to just sign into the AD domain but > get authenticated by the fact that they have a valid account in the > MIT kerberos KDC. > > Is this even possible? Yes that's possible. It should be quite easy to setup (some time ago I got it to w...

XP Workstation logging into Windows 2000/2003 AD Domain using MIT Kerberos KDC
I am pretty new to Kerberos so I may mess up the terminology. We have had a couple of people attempt what I am describing below and we have failed so far. I just wanted to consult the group with the basic "is this possible" question first, then expand on to broader questions like "who has done it" and "how is it done" We have a student lab of Windows XP computers and we want the students to have to authenticate to use them. We have an MIT Kerberos KDC that "knows" all the students but we do not want the MIT KDC to have to know each and every XP workstation. We would like to set up a Windows Server 2003 (or 2000 if that makes a difference) AD Domain Controller that the students log into, but we ant that AD Domain controller to contact the MIT KDC for authentication purposes. If we have to create explicit user accounts for each student in the Windows Active Directory Domain we will, but if we could map them all to a single account that would also be good. In other words, we are willing to let the MIT KDC talk to the Windows AD Domain Controller, not all the workstations. We want the XP workstations to contact the Windows Domain Controller and have the Windows Domain COntroller touch base with the MIT KDC to authenticate them. I have set up a Windows Server 2003 AD Domain controller, It is all working well from a DNS point of view. It is actually talking to the MIT KDC but so far all I have gotten is Windows error from the tickets ...

Samba 3.0 as Active Directory Domain Controller with MIT Kerberos 1.3 KDC?
"Gerald (Jerry) Carter" <jerry@samba.org> wrote in message news:<zwyd.1Tn.5@gated-at.bofh.it>... > The Samba Team is proud to announce the availability of the > first official release of the Samba 3.0 code base. > > Major new features: > - ------------------- > > 1) Active Directory support. Samba 3.0 is now able to > join a ADS realm as a member server and authenticate > users using LDAP/Kerberos. > Hi Gerald (Jerry) and Samba Team! Before anythings else, I'd just like to start by thanking you for your magnificent contribution to the Open Source community. I've been using Samba in various contexts for almost 2 years now and it's been a huge benefit to me. Thank you, Thank you, Thank you! I've been using Samba 2.2 as a PDC for a production environment with Windows XPP and Windows 2000 Pro clients and serving up a database application and Samba does beautifully at this task and has done so for more than a year. Since I see that with 3.0, Samba now supports Active Directory, it occurs to me that I might now be able to use Samba as an emulated Windows 2000 Domain Controller (i.e., an Active Directory Domain Controller with Kerberos), but perhaps that level of functionality is not there yet? I see in the Samba-HOWTO collection documentation (included with the 3.0 stable tarball and dated 21 April 2003) the following statements: ===================== The foll...

MIT Kerberos and Solaris 10 Kerberos
Greetings, everyone. We run a number of Solaris 8 systems using Sun's SEAM PAM implementation and MIT's Kerberos (which we're up to date on). We are starting to look at Solaris 10, and are hoping to move towards Sun's implementation of Kerberos. We are having a bit of trouble getting the two to talk properly, however. If we SSH (from production to test, for example) to a Solaris 8 machine, then we can rlogin (Kerberized) to the Solaris 10 machine and, from there, rlogin to a Sol8 machine again. If, however, we SSH directly to the Solaris 10 machine, we cannot rlogin to a Solaris 8 machine. Doing various experiments (for example, trying to ksu on the Sol 10 machine), the only error we ever get is: ksu WARNING: Your password may be exposed if you enter it here and are logged in remotely using an unsecure (non-encrypted) channel. Kerberos password for ux5p@ATCOTEST.CA: : ksu: Server not found in Kerberos database while geting credentials from kdc Authentication failed. Doing an rlogin to a Sol 8 machine gives no errors at all; it just quietly fails. The above error seems to indicate that the Solaris 10 Kerberos isn't passing the tickets to the Sol 8/MIT Kerberos servers (which, based upon certain differences, would not be a big surprise). Has anyone gotten this to work? The Sol 10 system is using the default Solaris 10 PAM implementation as well; not sure if this is part of the problem, but the configuration files are significantly different. Th...

Variable kdc on kerberos.
Hi All, is there a way to set a variable, instead of a constant on the kerberos config file under the kdc option? I've a lot of Active Directory on my network, so if I want contact the closer one I've to use variables to retrieve informations of our local Dns. Many thanks ...

FW: MIT Kerberos and Solaris 10 Kerberos
Sorry, I accidentally sent this reply just to Wyllys. In the interest of keeping the thread complete, I'll put it to the list as well. R > That's because Solaris 10 'kadmin' uses RPCSEC_GSS and > MIT uses a slightly different RPC protocol. This is not a new > issue, its been a problem ever since we introduced SEAM. > > The solution is that if your KDC is MIT, then you must use the MIT > 'kadmin' client to manage it. OK, thanks. So, I'll have to keep the MIT binaries around as well... Rainer ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos ...

Web resources about - question about MIT Kerberos KDC processing PROXY KDC requests - comp.protocols.kerberos

Analog signal processing - Wikipedia, the free encyclopedia
Analog signal processing is any signal processing conducted on analog signals by analog means. "Analog" indicates something that is mathematically ...

Conexant Announces New Audio Processing Solutions At CES
At CES, Conexant gave me a demo of some of the audio processing technology that they've been working on. Conexant is a company that probably ...

Common payment processing protocols found to be full of flaws
Credit card users could have their PINs stolen, and merchants could have their bank accounts pillaged, in a set of attacks demonstrated by researchers ...

Government "Processing Error" Sinks Housing Reports for Entire Year; Where to From Here?
Huge "Processing Error" in Government Housing Data When I saw some of the upwardly revised GDP estimates in 2015 I thought they were too good ...

THE PAYMENTS ECOSYSTEM: Everything you need to know about the next era of payment processing
The way we pay has changed dramatically. People are using their smartphones for every kind of formal and informal transaction — to shop at stores, ...

Audi turns to Qualcomm power for entertainment, navigation processing
Qualcomm proves its chip-making innovation, announcing a deal at CES where Audi will use its first automotive quality infotainment chipset, the ...

Feds Stop Processing NICS Denial Appeals
Obama Administration Enacts More Gun Control By Misusing FBI Background Check System

This just in: Marco Rubio's substance is thinner than an Intel processing chip
In case you hadn't already guessed it, Marco Rubio's got a smile and a stump speech, but that's about it. Reporters who have followed him from ...

Food Processing: It's What Makes Us Human
Turning raw ingredients into something more has played an important role in our evolution.

Nvidia Ramps Up Processing Power for Self-Driving Cars
With its new Drive PX 2 platform, the GPU maker is offering a computer that can deliver up to 8 teraflops of computing power to autonomous vehicles. ...

Resources last updated: 3/10/2016 1:46:04 PM