RHBA-2011:0571 - Bug Fix Advisory

Topic

Updated krb5 packages that fix multiple bugs are now available for Red Hat
Enterprise Linux 6.

Description

Kerberos is a network authentication system which allows clients and servers to
authenticate to each other using symmetric encryption and a trusted third-party,
the Key Distribution Center (KDC).

Kerberos has been upgraded to version 1.9, which provides a number of bug fixes
over the previous version. (BZ#642417)

This update fixes the following bugs:

• Previously, no IPv6 suport was available for kprop, kpropd, kadmin and

kadmind. This update adds IPv6 support to these utilities. (BZ#595841,
BZ#595842)

• Previously, the krbPwdExpiration attribute in the principal's entry would

often be ignored when the realm database was stored in a directory server. This
update fixes this problem and this attribute is no longer ignored. (BZ#627039)

• Previously, kinit with smart card login did not authenticate to the KDC

correctly if the certificate on the smart card did not contain a subjectAltName
extension or multiple certificates were available and krb5.conf was configured
to select according to the value of the keyUsage extension in the certificates.
This update continues to look for certificates with the right extension and
corrects the valuation. (BZ#629022)

• Previously, the init script for the kpropd was not Linux Standards Base (LSB)

compliant. With this update, this init script is LSB compliant. (BZ#630587)

• Previously, the KDC log files were not rotated by default. This update

corrects this problem. Now these log files are rotated correctly. (BZ#630968)

• Previously, logins failed if the user had a .k5login file which did not

explicitly contain the user's principal name. With this update, this check can
be disabled using the "k5login_authoritative" setting in krb5.conf. (BZ#646499)

• Previously, GSSAPI authentication from Windows clients using cross-realm

authentication failed if the client's ticket included a Privilege Attribute
Certificate (PAC) with a failed signature check. Failed signature checks are now
ignored. (BZ#679612)

All krb5 users are advised to upgrade to these updated packages, which fix these
bugs.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259/

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x

Fixes

• BZ - 595841 - krb5's kprop/kpropd needs to support IPv6 connections
• BZ - 595842 - krb5's libgssrpc/kadmin/kadmind needs to support IPv6 connections
• BZ - 627039 - Incorrect handling of password expiration
• BZ - 629022 - 'kinit' with smart card login fails to authenticate to the kdc using the cert and its private key.
• BZ - 630968 - Kerberos server log does not get rotated
• BZ - 636985 - A KDC which offers PKINIT preauthentication may not accept requests from a RHEL 5 client
• BZ - 642417 - Rebase Kerberos to 1.9
• BZ - 646499 - pam_krb5 requires self principal to be listed in .k5login

CVEs

(none)

References

(none)