Re: aname_to_locaname vs gssapi svc/host.domain.org@REALM

Harry Coin <[email protected]> writes:

> Note krb5_kuserok() is indeed called by this function -- doing
> authentication+authorization but only in the event of a two part
> principal name ending in /root.  Let it be just 'root@realm' and you get
> realm checking but nothing more.

Indeed, creating a Kerberos principal named "root" is generally a very bad
idea, since as jhutz points out, the most common authorization fallback in
the Kerberos world is to assume a principal in the system's local realm
should have access to a UNIX account whose name matches the LHS of the
principal.

Now, one should have defense in depth against this because lots of UNIX
implementations come with various system accounts that may overlap with
your account namespace.  I encourage everyone deploying my PAM module to
use minimum_uid and allocate system accounts with UIDs lower than that UID
for this reason.  But it's usually also a good idea to reserve in your
Kerberos KDC principal names matching stock UNIX accounts (root, sys, bin,
etc.).

-- 
Russ Allbery ([email protected])             <http://www.eyrie.org/~eagle/>