MIT Kerberos for Debian

MIt distributes the Kerberos sources a series of PGP-signed tarballs
tarred up into a single .tar file.  In order to create the Debian
Original upstream sources (.orig.tar.gz), I checked the PGP signatures
and untarred all the .tar.gz files, repacking the resulting krb5-1.2.1
directory.


MIT Kerberos is built against the libcom_err and libss from the
e2fsprogs.  IT is built against the version of db included in
src/util/db2 in the Kerberos sources.    IN the future I may update to
using db4, although doing so will make upgrades somewhat difficult.

I do not install any of the sample clients and servers.  As a general
rule these are not useful unless you are doing development.  In such a
situation, you probably want to build them from source.

Note that by default, no unencrypted services are enabled.  That means
you need to use rlogin -x to connect to a Debian system and if you use
rsh without the -x option you will get an error that encryption is
required.  In this day and age, not encrypting network traffic is a
good way to get attacked.


Krb524 AFS Conversion
---------------------

An alternate conversion is provided for AFS servers that support the
encrypted part of a krb5 ticket as an AFS token.  If the krb524d is
converting a principal whose first component is afs and if the
encrypted part of the ticket fits in 344 bytes, then it will default
to simply returning the encrypted part of the ticket as a token.  If
it turns out that the AFS server does not support the ticket, then
users will get an unknown key version error and the krb524d must be
configured to use v4 tickets for this AFS service.

The krb524d looks in the appdefaults  section of krb5.conf for an
application called afs_krb5 to determine whether  afs principals
support encrypted ticket parts as tokens.  The following configuration
fragment says that afs/sipb.mit.edu@ATHENA.MIT.EDU supports the new
token format but afs@ATHENA.MIT.EDU and
afs/athena.mit.edu@ATHENA.MIT.EDU do not.  Note that the default is to
assume afs servers support the new format.
# You'll actually have to remove the comments from inside braces
# they don't work but are included for clarity

[appdefaults]
afs_krb5 = { 
	ATHENA.MIT.EDU = {
		# This stanza describes principals in the
		#ATHENA.MIT.EDU realm
		afs = false
		afs/athena.mit.edu = false
		afs/sipb.mit.edu = true
	}
}

 -- Sam Hartman <hartmans@debian.org>, Sun Feb 29 09:13:13 2004
