[28360] in Kerberos
Re: Kerberos and IP aliases
daemon@ATHENA.MIT.EDU (Russ Allbery)
Wed Sep 5 15:31:16 2007
From: Russ Allbery <rra@stanford.edu>
To: Miguel Sanders <miguelsanders@telenet.be>
In-Reply-To: <1189018083.828358.207110@k79g2000hse.googlegroups.com> (Miguel
Sanders's message of "Wed, 05 Sep 2007 11:48:03 -0700")
Date: Wed, 05 Sep 2007 12:30:57 -0700
Message-ID: <87642o9afi.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Miguel Sanders <miguelsanders@telenet.be> writes:
> I was just wondering how Kerberos reacts to IP aliases (virtual IP
> addresses). Do you have to create a host principal for the virtual
> hostname aswell?
Generally, yes.
Kerberos itself doesn't know anything about such things and just
authenticates whatever principal the client uses using its keys. However,
the client has to know what the server identity is in order to
authenticate. While it's possible to make the user explicitly specify an
identity, that's unusual and in practice the client usually guesses based
on the hostname.
In some cases the client will just use whatever hostname is given on the
command line, but in many cases it will do a forward and reverse DNS
lookup to canonicalize the hostname (although this is less secure if you
can't trust DNS, and most people can't). So in practice the server needs
to have a key for all identities that might result from either of those
approaches.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
