[27698] in Kerberos
Re: confusion in ank.
daemon@ATHENA.MIT.EDU (Kevin Coffman)
Mon Apr 23 13:05:49 2007
Message-ID: <4d569c330704231003o68d4a86bif2530b9995134f8@mail.gmail.com>
Date: Mon, 23 Apr 2007 13:03:59 -0400
From: "Kevin Coffman" <kwc@citi.umich.edu>
To: "Vipin Rathor" <v.rathor@gmail.com>, kerberos@mit.edu
In-Reply-To: <20070423155235.GE12578@Sun.COM>
MIME-Version: 1.0
Content-Disposition: inline
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On 4/23/07, Nicolas Williams <Nicolas.Williams@sun.com> wrote:
> On Mon, Apr 23, 2007 at 11:27:22AM -0400, Kevin Coffman wrote:
> > I haven't looked at the code, but I think this is probably done on
> > purpose and is not a bug. When you create a keytab, you create a new
> > random key for the account. There is no password associated with that
> > key, and there is no longer a reason for a password expiration.
>
> Password quality policies certainly shouldn't apply to randomly-
> generated keys, but that does not mean that there cannot be a key
> expiration policy.
OK, I looked at the code.
If the principal has a policy, and the policy has a pw_max_life, the
password expiration is updated. If the principal has no policy, then
the password expiration is reset. So I'm assuming this principal is
not associated with a policy, or the policy doesn't have a
pw_max_life.
>From src/lib/kadm5/srv/svr_principal.c: kadm5_randkey_principal_3():
if ((adb.aux_attributes & KADM5_POLICY)) {
if ((ret = kadm5_get_policy(handle->lhandle, adb.policy,
&pol)) != KADM5_OK)
goto done;
have_pol = 1;
ret = krb5_dbe_lookup_last_pwd_change(handle->context,
&kdb, &last_pwd);
if (ret)
goto done;
#if 0
/*
* The spec says this check is overridden if the caller has
* modify privilege. The admin server therefore makes this
* check itself (in chpass_principal_wrapper, misc.c). A
* local caller implicitly has all authorization bits.
*/
if((now - last_pwd) < pol.pw_min_life &&
!(kdb.attributes & KRB5_KDB_REQUIRES_PWCHANGE)) {
ret = KADM5_PASS_TOOSOON;
goto done;
}
#endif
if(pol.pw_history_num > 1) {
if(adb.admin_history_kvno != hist_kvno) {
ret = KADM5_BAD_HIST_KEY;
goto done;
}
ret = check_pw_reuse(handle->context, &hist_key,
kdb.n_key_data, kdb.key_data,
adb.old_key_len, adb.old_keys);
if (ret)
goto done;
}
if (pol.pw_max_life)
kdb.pw_expiration = now + pol.pw_max_life;
else
kdb.pw_expiration = 0;
} else {
kdb.pw_expiration = 0;
}
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
