[25005] in Kerberos
Re: Possible to use only IP addresses in MIT Kerberos (ie: disable
daemon@ATHENA.MIT.EDU (Fredrik Tolf)
Mon Nov 28 18:50:56 2005
From: Fredrik Tolf <fredrik@dolda2000.com>
To: rchowneltura@hotmail.com
In-Reply-To: <1132767798.753440.270460@o13g2000cwo.googlegroups.com>
Content-Type: text/plain
Date: Sun, 27 Nov 2005 21:58:23 +0100
Message-Id: <1133125103.28572.32.camel@pc7.dolda2000.com>
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
On Wed, 2005-11-23 at 09:43 -0800, rchowneltura@hotmail.com wrote:
> Hi, I am investigating kerberizing of our application using
> MIT Kerberos5. Due to the nature of our application,
> we cannot use DNS and must use host IP addresses
> instead of hostnames during authentication.
I believe that host names are required for Kerberos operation, since
they are used in the service principal names.
However, host names aren't necessarily transferred over DNS. I also have
this problem when using services over IPv6, and to help out, I
implemented the FQDN over ICMP service for Linux. If you, too, are using
Linux, you can use the program:
<http://www.dolda2000.com/~fredrik/icmp-dn/>
FQDN over ICMP is specified in RFC 1788 -- it's just that neither the
Linux kernel nor any standard glibc NSS module implements it. Meaning:
It's not just some homebrew protocol of mine, but an open standard. I
don't think Windows supports it, but I'm fairly sure that it would work
when talking to *BSD machines.
Fredrik Tolf
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
