Updated krb5 packages that fix several bugs are now available for Red Hat Enterprise Linux 6.
Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third-party, the Key Distribution Center (KDC).
The krb5 packages have been upgraded to upstream version 1.10.3, which provides a number of bug fixes over the previous version, including better support of cross-domain trust functionality in other packages. (BZ#823926)
- Older versions of the libsmbclient package incorrectly depended on the krb5_locate_kdc() function, which is no longer supported. Consequently, applications which used older versions of libsmbclient became incompatible after the Kerberos library update. With this update, an explicit conflict with older versions of libsmbclient has been added. As a result, an incompatible combination cannot be installed.
- Previously, when the krb5-auth-dialog application was used and the prompter was left hanging for a long period of time, a large clock skew was mistakenly recorded. This clock drift was applied in the next kinit session. Consequently, the klist function reported an incorrect expiration time. This bug has been fixed, and the spurious time offset no longer occurs in the described scenario.
- Previously, when a list of trusted roots of a PKINIT client included the KDC's certificates, certain KDC implementations omitted such anchors from the list of certificates in the signed data structure. Consequently, the client failed to verify the KDC's signature on the signed data. With this update, a backported fix has been included to allow the client to use its own copies of relevant certificates. As a result, the verification no longer fails in the aforementioned scenario.
- Prior to this update, attempts to use the kinit command with a keytab file often failed when the keytab file did not contain the Advanced Encryption Standard (AES) keys, but the client's libraries and the KDC both supported AES. The strongest supported encryption type (AES) was chosen by default, even though it was not present in keytab. Consequently, a mismatch error occurred. The bug has been fixed, and keytabs containing any of the supported encryption types are now correctly processed.
- Previously, the krb5 package did not handle the timeout variable properly. In certain cases, the timeout variable became a negative number. Consequently, the client entered a loop while checking for responses. With this update, the client logic has been modified and the described error no longer occurs.
- Prior to this update, the passwd utility failed when used by an Identity Management client. Consequently, an error occurred with the following message:token manipulation errorThe bug has been fixed, and the passwd utility now works with Identity Management as expected.
- BZ#845125, BZ#846472
- Due to a previous update to a locally-applied patch, files created by the libkrb5 library were given correct SELinux labels. However, each flushing of the replay cache caused the file context configuration to be reloaded to ensure that the correct label is applied to the newly-created replacement replay cache file. This resulted in large performance degradation in applications which accept authentication and use replay caches. With this update, the context configuration is only loaded when the context configuration file has been modified and the configuration is now freed only when the library is unloaded or the calling application exits, thus greatly lowering the impact of this problem.
All users of krb5 are advised to upgrade to these updated packages, which fix these bugs.