Re: Custom DNS settings for different applications
"Henry B. Hotz" <[email protected]>
| Newsgroups | gmane.comp.encryption.kerberos.heimdal.general |
|---|---|
| Message-ID | <[email protected]> |
Looks like you've researched the options. I hope you find ones that will work for you. Some specific comments in-line. On Nov 9, 2011, at 1:03 PM, Jaideep Padhye wrote: > Hi, > > > I have a particular use case where I need some advice. The question is regarding the following settings in the krb5.conf file: > > dns_canonicalize_hostname > dns_lookup_realm > dns_lookup_kdc > > I have an application A, which needs the above mentioned settings to be true for the context it uses. > Then there is application B which needs to block all DNS queries for performance reasons as DNS queries are costly. > > According to my understanding this can be achieved in following ways: > > 1] Programmatically by using functions like krb5_set_dns_canonicalize_hostname (). But, such kinds of functions are not present for all the above settings. I would hope you don't need to modify your app this way. OTOH if there really are options missing such overrides, could you document them? > 2] By using different configuration files for different applications. But, I'm not sure if this is possible as I couldn't find appropriate APIs. This is probably the way most people do it. Just set the KRB5_CONFIG environment variable to the krb5.conf you want to use. > 3] By using different sections in same configuration file for different applications. Not sure if this is possible either. This is probably the way you're "supposed" to do it. Since I'm always trying to make the default behavior "correct" I confess I haven't looked at it much. Possible issues are how the application name gets set/used and that the DNS options are libdefaults, not application defaults. > Can someone help me with what are the practical options I have for achieving the end goal? > Personally, I would have liked to be able to do something like option 3 mentioned above. I'd agree 3 is preferred. If it's possible, you'll need to "use the source" to get all the info you need though. > I'm currently using heimdal-1.4.1rc2 source. > > Thanks, > > Jaideep ------------------------------------------------------ The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. [email protected], or [email protected]