On Wed, Jun 26, 2002 at 07:35:14PM +1000, Damien Miller
wrote:> Can anyone with Heimdal KrbV verify this?
I've used this patch for many moons with Heimdal. It should do the
right thing in the MIT Kerberos case, also.
--- servconf.c Fri Jun 21 01:20:44 2002
+++ servconf.c.good Wed Jun 26 09:05:09 2002
@@ -16,13 +16,7 @@
#include <krb.h>
#endif
#if defined(KRB5)
-#ifdef HEIMDAL
-#include <krb.h>
-#else
-/* Bodge - but then, so is using the kerberos IV KEYFILE to get a Kerberos V
- * keytab */
-#define KEYFILE "/etc/krb5.keytab"
-#endif
+extern const char *krb5_defkeyname;
#endif
#ifdef AFS
#include <kafs.h>
@@ -130,6 +124,10 @@
void
fill_default_server_options(ServerOptions *options)
{
+ int krb4_keyfile, krb5_keyfile;
+
+ krb4_keyfile = krb5_keyfile = 0;
+
/* Portable-specific options */
if (options->pam_authentication_via_kbd_int == -1)
options->pam_authentication_via_kbd_int = 0;
@@ -199,9 +197,15 @@
options->rsa_authentication = 1;
if (options->pubkey_authentication == -1)
options->pubkey_authentication = 1;
+#ifdef KRB4
+ krb4_keyfile = (access(KEYFILE, R_OK) == 0);
+#endif
+#ifdef KRB5
+ krb5_keyfile = (access(krb5_defkeyname, R_OK) == 0);
+#endif
#if defined(KRB4) || defined(KRB5)
if (options->kerberos_authentication == -1)
- options->kerberos_authentication = 0;
+ options->kerberos_authentication = krb4_keyfile||krb5_keyfile;
if (options->kerberos_or_local_passwd == -1)
options->kerberos_or_local_passwd = 1;
if (options->kerberos_ticket_cleanup == -1)
Content-Description: Forwarded message - Kerberos buglet in
OpenSSH-3.3p1> Date: 25 Jun 2002 14:52:10 +0200
> From: Dag-Erling Smorgrav <des at ofug.org>
> To: djm at mindrot.org
> Subject: Kerberos buglet in OpenSSH-3.3p1
>
> servconf.c includes the wrong header for Kerberos V:
>
> --- servconf.c 24 Jun 2002 22:46:15 -0000 1.111
> +++ servconf.c 25 Jun 2002 01:16:22 -0000
> @@ -17,7 +17,7 @@
> #endif
> #if defined(KRB5)
> #ifdef HEIMDAL
> -#include <krb.h>
> +#include <krb5.h>
> #else
> /* Bodge - but then, so is using the kerberos IV KEYFILE to get a Kerberos
V
> * keytab */
>
> DES
> --
> Dag-Erling Smorgrav - des at ofug.org
--
Jacques A. Vidrine <n at nectar.cc> http://www.nectar.cc/
NTT/Verio SME . FreeBSD UNIX . Heimdal Kerberos
jvidrine at verio.net . nectar at FreeBSD.org . nectar at kth.se