From: Steve Dickson <SteveD@redhat.com>
To: Kevin Coffman <kwc@citi.umich.edu>
Cc: Trond Myklebust <Trond.Myklebust@netapp.com>, linux-nfs@vger.kernel.org
Subject: Re: [PATCH 10/22] gss_krb5: Add upcall info indicating supported kerberos enctypes
Date: Wed, 14 Apr 2010 15:54:46 -0400 [thread overview]
Message-ID: <4BC61D86.3040805@RedHat.com> (raw)
In-Reply-To: <z2g4d569c331004141250v44e3b011l6e9c953185b04625@mail.gmail.com>
On 04/14/2010 03:50 PM, Kevin Coffman wrote:
> On Wed, Apr 14, 2010 at 3:32 PM, Steve Dickson <SteveD@redhat.com> wrote:
>> On 04/14/2010 02:51 PM, Kevin Coffman wrote:
>>>
>>> Hi Steve,
>>> This surprises me. I believe this would result in DES being used
>>> rather than the stronger enctypes. Can you give me more details of
>>> the problems you saw?
>>
>> In limit_krb5_enctypes(), if I did not give gss_set_allowable_enctypes()
>> the list of enctypes in an increasing order, creating the krb5 context for
>> root would fail. When gave them in order root got its context...
>>
>> I figured it was some type of krb5 lib quirk, since the default enctypes
>> are also in increasing order...
>>
>> steved.
>
> Note that I have seen the DES preferences listed as both 3,1,2 and 1,3,2.
>
> The default list in limit_krb5_enctypes() is [ENCTYPE_DES_CBC_CRC,
> ENCTYPE_DES_CBC_MD5, ENCTYPE_DES_CBC_MD4], or 1,3,2
>
> I suspect there must have been some other issue when you tested?
Not that I saw... when I made that kernel change, rebooted, restarted
everything, I never saw the problem again...
steved.
next prev parent reply other threads:[~2010-04-14 19:55 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-04-14 17:36 [PATCH 00/22] Add support for more RPCSEC_GSS/krb5 enctypes Trond Myklebust
2010-04-14 17:36 ` [PATCH 01/22] gss_krb5: Introduce encryption type framework Trond Myklebust
2010-04-14 17:36 ` [PATCH 02/22] gss_krb5: Added and improved code comments Trond Myklebust
2010-04-14 17:36 ` [PATCH 03/22] gss_krb5: Don't expect blocksize to always be 8 when calculating padding Trond Myklebust
2010-04-14 17:36 ` [PATCH 04/22] gss_krb5: split up functions in preparation of adding new enctypes Trond Myklebust
2010-04-14 17:36 ` [PATCH 05/22] gss_krb5: prepare for new context format Trond Myklebust
2010-04-14 17:36 ` [PATCH 06/22] gss_krb5: introduce encryption type framework Trond Myklebust
2010-04-14 17:36 ` [PATCH 07/22] gss_krb5: add ability to have a keyed checksum (hmac) Trond Myklebust
2010-04-14 17:36 ` [PATCH 08/22] gss_krb5: import functionality to derive keys into the kernel Trond Myklebust
2010-04-14 17:36 ` [PATCH 09/22] gss_krb5: handle new context format from gssd Trond Myklebust
2010-04-14 17:36 ` [PATCH 10/22] gss_krb5: Add upcall info indicating supported kerberos enctypes Trond Myklebust
2010-04-14 17:36 ` [PATCH 11/22] gss_krb5: add support for triple-des encryption Trond Myklebust
2010-04-14 17:36 ` [PATCH 12/22] gss_krb5: Advertise triple-des enctype support in the rpcsec_gss/krb5 upcall Trond Myklebust
2010-04-14 17:36 ` [PATCH 13/22] xdr: Add an export for the helper function write_bytes_to_xdr_buf() Trond Myklebust
2010-04-14 17:36 ` [PATCH 14/22] gss_krb5: add support for new token formats in rfc4121 Trond Myklebust
2010-04-14 17:36 ` [PATCH 15/22] gss_krb5: add remaining pieces to enable AES encryption support Trond Myklebust
2010-04-14 17:36 ` [PATCH 16/22] gss_krb5: Advertise AES enctype support in the rpcsec_gss/krb5 upcall Trond Myklebust
2010-04-14 17:36 ` [PATCH 17/22] gssd_krb5: arcfour-hmac support Trond Myklebust
2010-04-14 17:36 ` [PATCH 18/22] gss_krb5: Save the raw session key in the context Trond Myklebust
2010-04-14 17:36 ` [PATCH 19/22] gssd_krb5: More arcfour-hmac support Trond Myklebust
2010-04-14 17:36 ` [PATCH 20/22] gss_krb5: Use confounder length in wrap code Trond Myklebust
2010-04-14 17:36 ` [PATCH 21/22] gss_krb5: Add support for rc4-hmac encryption Trond Myklebust
2010-04-14 17:36 ` [PATCH 22/22] gss_krb5: Advertise rc4-hmac enctype support in the rpcsec_gss/krb5 upcall Trond Myklebust
2010-04-14 18:30 ` [PATCH 10/22] gss_krb5: Add upcall info indicating supported kerberos enctypes Kevin Coffman
2010-04-14 18:37 ` Trond Myklebust
2010-04-14 18:51 ` Kevin Coffman
2010-04-14 19:32 ` Steve Dickson
2010-04-14 19:50 ` Kevin Coffman
2010-04-14 19:54 ` Steve Dickson [this message]
2010-04-15 11:34 ` Steve Dickson
2010-04-15 13:17 ` Kevin Coffman
2010-04-15 13:22 ` Trond Myklebust
2010-04-15 13:31 ` Trond Myklebust
2010-04-14 17:47 ` [PATCH 00/22] Add support for more RPCSEC_GSS/krb5 enctypes J. Bruce Fields
2010-04-14 17:54 ` Trond Myklebust
2010-04-14 19:36 ` Steve Dickson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4BC61D86.3040805@RedHat.com \
--to=steved@redhat.com \
--cc=Trond.Myklebust@netapp.com \
--cc=kwc@citi.umich.edu \
--cc=linux-nfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox