<br><font size=2 face="sans-serif">Dear Kerberos Support Analyst:</font>
<br>
<br><font size=2 face="sans-serif">At the outset I would like to convey our sincere thanks for providing an excellent support to the IT community on KRB matters.</font>
<br>
<br><font size=2 face="sans-serif">We are currently working on integrating an Oracle product with a Kerberos server. My colleague Jim McBride had written to krbdev@mit.edu and Sam Harman responded with his comments that as long as </font><font size=2 face="Courier New">gethostbyaddr(gethostbyname(gethostname()))</font><font size=2 face="sans-serif"> returns FQDN, things should work fine.</font>
<br>
<br><font size=2 face="sans-serif">Oracle insists that we need to provide the FQDN in the /etc/hosts file and all along we have been telling them that it is not a MUST for us to put the FQDN name in the /etc/hosts files. Although Oracle's argument makes sense in a set-up where DNS is not configured correctly, we all know it, from the Name Service management perspective it is not a good idea to have the FQDN in the /etc/hosts. We should let the resolver libraries take care of the FQDN issues while making sue that the DNS is configured according to the specifications.</font>
<br>
<br><font size=2 face="sans-serif">I am more than convinced that our environment is correctly configured and any application which relies on resolver libraries to derive the FQDN of the host will work correctly in our environment. I do not find it necessary to put the FQDN of the host in /etc/hosts file of the machine ( which makes the DNS set-up meaningless).</font>
<br>
<br><font size=2 face="sans-serif">I wrote a very simple program (fqdn_of_host.c) to demonstrate that the resolver libraries are working correctly in an environment where DNS is setup properly and kerberos applications will work correctly in the same environment.</font>
<br>
<br>
<br><font size=2 face="sans-serif">==================================================================================================</font>
<br><font size=2 face="sans-serif">Some of the AIX commands produce the following results :</font>
<br>
<br><font size=2 face="sans-serif">root@denver $ hostname</font>
<br><font size=2 face="sans-serif">denver</font>
<br>
<br><font size=2 face="sans-serif">root@denver $ host denver</font>
<br><font size=2 face="sans-serif">denver.r2.fs.fed.us is 9.99.15.50</font>
<br>
<br><font size=2 face="sans-serif">root@denver $ nslookup denver</font>
<br><font size=2 face="sans-serif">Server: netsrv.fs.fed.us</font>
<br><font size=2 face="sans-serif">Address: 9.99.15.100</font>
<br>
<br><font size=2 face="sans-serif">Name: denver.r2.fs.fed.us</font>
<br><font size=2 face="sans-serif">Address: 9.99.15.50</font>
<br>
<br><font size=2 face="sans-serif">root@denver $ nslookup 9.99.15.50</font>
<br><font size=2 face="sans-serif">Server: netsrv.fs.fed.us</font>
<br><font size=2 face="sans-serif">Address: 9.99.15.100</font>
<br>
<br><font size=2 face="sans-serif">Name: denver.r2.fs.fed.us</font>
<br><font size=2 face="sans-serif">Address: 9.99.15.50</font>
<br>
<br><font size=2 face="sans-serif">root@denver $ ifconfig en0</font>
<br><font size=2 face="sans-serif">en0: flags=e080863<UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST,GROUPRT,64BIT></font>
<br><font size=2 face="sans-serif"> inet 9.99.15.50 netmask 0xffffff00 broadcast 9.99.15.255</font>
<br><font size=2 face="sans-serif"><br>
</font>
<br><font size=2 face="sans-serif">=============================================================================================</font>
<br>
<br><font size=2 face="sans-serif">The /etc/hosts file on denver looks like </font>
<br>
<br><font size=2 face="sans-serif">127.0.0.1 loopback localhost # loopback (lo0) name/address</font>
<br><font size=2 face="sans-serif">9.99.15.50 denver<br>
=============================================================================================</font>
<br><font size=2 face="sans-serif">The /etc/resolv.conf file on denver looks like</font>
<br>
<br><font size=2 face="sans-serif">nameserver 9.99.15.100</font>
<br><font size=2 face="sans-serif">search r1.fs.fed.us r2.fs.fed.us r3.fs.fed.us r6.fs.fed.us boulder.ibm.com ibm.com fs.fed.us </font>
<br><font size=2 face="sans-serif">nameserver 9.17.223.121</font>
<br><font size=2 face="sans-serif">=============================================================================================</font>
<br><font size=2 face="sans-serif">The /etc/netsvc.conf file on the machine looks like:</font>
<br>
<br><font size=2 face="sans-serif">hosts=bind4,local</font>
<br><font size=2 face="sans-serif">=============================================================================================</font>
<br><font size=2 face="sans-serif">/* </font>
<br><font size=2 face="sans-serif"> Source code for fqdn_of_host.c </font>
<br>
<br><font size=2 face="sans-serif">*/</font>
<br>
<br><font size=2 face="sans-serif">#include <stdio.h></font>
<br><font size=2 face="sans-serif">#include <strings.h></font>
<br><font size=2 face="sans-serif">#include <netdb.h></font>
<br><font size=2 face="sans-serif">#include <sys/types.h></font>
<br><font size=2 face="sans-serif">#include <sys/socket.h></font>
<br><font size=2 face="sans-serif">#include <netinet/in.h></font>
<br><font size=2 face="sans-serif">#include <arpa/inet.h></font>
<br><font size=2 face="sans-serif">#include <unistd.h></font>
<br>
<br><font size=2 face="sans-serif">main(argc, argv)</font>
<br><font size=2 face="sans-serif">int argc;</font>
<br><font size=2 face="sans-serif">char *argv[];</font>
<br><font size=2 face="sans-serif">{</font>
<br>
<br><font size=2 face="sans-serif"> unsigned char host_name[1024],</font>
<br><font size=2 face="sans-serif"> name[100],</font>
<br><font size=2 face="sans-serif"> *ptr,</font>
<br><font size=2 face="sans-serif"> a[4];</font>
<br>
<br><font size=2 face="sans-serif"> static char domain_name[100],</font>
<br><font size=2 face="sans-serif"> addrbuf[32], *ch;</font>
<br>
<br><font size=2 face="sans-serif"> int domain_len;</font>
<br>
<br><font size=2 face="sans-serif"> struct hostent *hostptr;</font>
<br>
<br><font size=2 face="sans-serif"> int i,</font>
<br><font size=2 face="sans-serif"> count,</font>
<br><font size=2 face="sans-serif"> ai[4];</font>
<br>
<br><font size=2 face="sans-serif"> gethostname(host_name, sizeof(host_name) );</font>
<br><font size=2 face="sans-serif"> ptr=host_name ;</font>
<br><font size=2 face="sans-serif"> printf ("Host Name by gethostname() : %s \n", ptr);</font>
<br><font size=2 face="sans-serif"> </font>
<br><font size=2 face="sans-serif"> hostptr = gethostbyname(ptr);</font>
<br><font size=2 face="sans-serif"> printf ("\nHost Name by gethostbyname() : %s \n", hostptr->h_name);</font>
<br>
<br><font size=2 face="sans-serif"> for (i = 0; hostptr->h_aliases[i]; i++)</font>
<br><font size=2 face="sans-serif"> printf ("Host Alias by gethostbyname() : %s\n", hostptr->h_aliases[i]);</font>
<br><font size=2 face="sans-serif"> </font>
<br><font size=2 face="sans-serif"> </font>
<br><font size=2 face="sans-serif"> ch = strchr(hostptr->h_name,'.');</font>
<br><font size=2 face="sans-serif"> if ( ch == NULL ){</font>
<br><font size=2 face="sans-serif"> printf ( "DNS Entry does nor exist as per the hostname returned by gethostbyname()\n");</font>
<br><font size=2 face="sans-serif"> }</font>
<br><font size=2 face="sans-serif"> else{</font>
<br><font size=2 face="sans-serif"> printf ( "Domain by gethostbyname() : %s\n", ++ch);</font>
<br><font size=2 face="sans-serif"> }</font>
<br>
<br><font size=2 face="sans-serif"> for (i=0; i<4; i++)</font>
<br><font size=2 face="sans-serif"> ai[i] = hostptr->h_addr_list[0][i];</font>
<br>
<br><font size=2 face="sans-serif"> for (i=0; i<4; i++)</font>
<br><font size=2 face="sans-serif"> a[i] = (unsigned char)(ai[i] & 0xFF);</font>
<br><font size=2 face="sans-serif"> snprintf(addrbuf, 32, "%d.%d.%d.%d", a[0], a[1], a[2], a[3]);</font>
<br><font size=2 face="sans-serif"> printf ("Host IP by gethostbyname() : %s\n", addrbuf);</font>
<br>
<br><font size=2 face="sans-serif"> hostptr = gethostbyaddr(a,4,AF_INET); </font>
<br><font size=2 face="sans-serif"> printf ("\nHost Name by gethostbyaddr() : %s \n", hostptr->h_name);</font>
<br><font size=2 face="sans-serif">}</font>
<br>
<br><font size=2 face="sans-serif">=============================================================================================</font>
<br><font size=2 face="sans-serif">cc fqdn_of_host.c -o fqdn_of_host</font>
<br>
<br><font size=2 face="sans-serif">When I run the compiled version of the above source code the output looks like:</font>
<br>
<br><font size=2 face="sans-serif">root@denver $ fqdn_of_host</font>
<br><font size=2 face="sans-serif">Host Name by gethostname() : denver </font>
<br>
<br><font size=2 face="sans-serif">Host Name by gethostbyname() : denver.r2.fs.fed.us </font>
<br><font size=2 face="sans-serif">Domain by gethostbyname() : r2.fs.fed.us</font>
<br><font size=2 face="sans-serif">Host IP by gethostbyname() : 9.99.15.50</font>
<br>
<br><font size=2 face="sans-serif">Host Name by gethostbyaddr() : denver.r2.fs.fed.us </font>
<br>
<br><font size=2 face="sans-serif">root@denver $ </font>
<br>
<br><font size=2 face="sans-serif">===============================================================================================<br>
</font>
<br><font size=2 face="sans-serif">I am of the opinion that " Oracle's argument that FQDN hostname must and should be present on the first line of the /etc/hosts file inorder for the kerberos server/clinet to work correctly does not make a good argument when DNS is configured correctly and it is assured that DNS will work correctly under all circumstances".</font>
<br>
<br>
<br><font size=2 face="sans-serif"><b><u>What am I requesting you for?</u></b></font>
<br>
<br><font size=2 face="sans-serif">Please confirm to us that " In the environment that has been described in this e-mail, it is NOT necessary for us to put the FQDN name of the host in /etc/hosts file for the kerberos server/client to work correctly "</font>
<br>
<br>
<br><font size=2 face="sans-serif">Once again, thanks for your help. A quick response to this is gratefully acknowledged.</font>
<br>
<br>
<br><font size=2 face="sans-serif">Regards,<br>
<br>
Sridhar<br>
<br>
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><br>
IBM BCS - Public Sector<br>
Voice (303) 924 - 0413<br>
Email murthys@us.ibm.com<br>
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>></font>
<br><font size=1 color=#800080 face="sans-serif">----- Forwarded by Sridhar Murthy/Boulder/IBM on 09/11/2003 11:37 PM -----</font>
<br>
<table width=100%>
<tr valign=top>
<td>
<td><font size=1 face="sans-serif"><b>James McBride</b></font>
<p><font size=1 face="sans-serif">09/10/2003 01:47 PM</font>
<br>
<td>
<br><font size=1 face="sans-serif"> To: Sridhar Murthy@IBMUS</font>
<br><font size=1 face="sans-serif"> cc: Steve Sipocz Jr/Boulder/IBM@IBMUS, wdeschene@fs.fed.us, glongsine@fs.fed.us, Richard A Ernst/Boulder/IBM@IBMUS</font>
<br><font size=1 face="sans-serif"> From: James McBride/Boulder/IBM@IBMUS</font>
<br><font size=1 face="sans-serif"> Subject: Re: /etc/hosts on a Kerberos client</font><a href=Notes:///8725657000306D26/38D46BF5E8F08834852564B500129B2C/1A0D726442B1B01D87256D9D00669152>Link</a>
<br></table>
<br>
<br><font size=2 face="sans-serif">Srihdar,</font>
<br><font size=2 face="sans-serif"> Can you write C program to verify that "</font><font size=2 face="Courier New">gethostbyaddr(gethostbyname(gethostname())) return a correct hostname with an FQDN</font><font size=2 face="sans-serif">"?<br>
</font>
<br><font size=2 face="sans-serif">TIA </font>
<br><font size=2 face="sans-serif"><br>
Jim McBride<br>
Oracle Deployment and Support<br>
IBM Corporation<br>
6300 Diagonal HWY., Stop 003E<br>
Boulder, CO 80301-9020<br>
Office: (303) 924-5626<br>
Lab: (303) 924-0212<br>
Fax: (303) 924-9233<br>
mcbridejt@us.ibm.com<br>
</font>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td>
<td><font size=1 face="sans-serif"><b>Sam Hartman <hartmans@mit.edu></b></font>
<p><font size=1 face="sans-serif">09/10/2003 12:40 PM</font>
<br>
<td><font size=1 face="Arial"> </font>
<br><font size=1 face="sans-serif"> To: James McBride/Boulder/IBM@IBMUS</font>
<br><font size=1 face="sans-serif"> cc: <krbdev@mit.edu>, wdeschene@fs.fed.us, Sridhar Murthy/Boulder/IBM@IBMUS, Kurt Bevers <Kurt.Bevers@oracle.com>, Steve Sipocz Jr/Boulder/IBM@IBMUS</font>
<br><font size=1 face="sans-serif"> Subject: Re: /etc/hosts on a Kerberos client</font>
<br></table>
<br>
<br>
<br><font size=2 face="Courier New">>>>>> "James" == James McBride <mcbridejt@us.ibm.com> writes:<br>
<br>
James> Dear Kerberos Support Analyst:<br>
<br>
James> Oracle Support is reporting that MIT Kerberos requires that<br>
James> the FQDN of a Kerberos client must be in the /etc/hosts<br>
James> file. They provided the URL below as a reference:<br>
James> http://web.mit.edu/kerberos/www/krb5-1.3/krb5-1.3.1<br>
James> /doc/krb5-admin.html#Getting%20DNS%20Information%20Correct<br>
<br>
James> We feel that Kerberos can use DNS and the operating system<br>
James> to determine the FQDN of a machine.<br>
<br>
James> Please provide your perspective on this.<br>
<br>
James> Thanks In Advance,<br>
<br>
<br>
James> Jim McBride Oracle Deployment and Support IBM Corporation<br>
James> 6300 Diagonal HWY., Stop 003E Boulder, CO 80301-9020<br>
James> Office: (303) 924-5626 Lab: (303) 924-0212 Fax: (303)<br>
James> 924-9233 mcbridejt@us.ibm.com<br>
<br>
James> _______________________________________________ krbdev<br>
James> mailing list krbdev@mit.edu<br>
James> https://mailman.mit.edu/mailman/listinfo/krbdev<br>
<br>
Hi. The address krbdev@mit.edu is not an appropriate place to request<br>
Kerberos support. This address is for discussion of development of<br>
MIt Kerberos. You may want to address support questions to<br>
kerberos@mit.edu in the future.<br>
<br>
<br>
That said, with regard to DNS and hostnames, the requirement is that<br>
gethostbyaddr(gethostbyname(gethostname())) return a correct hostname<br>
with an FQDN. The easiest way of guaranteeing this is to make sure<br>
that both /etc/hosts and DNS will correctly resolve the machine.<br>
<br>
Things that typically do not work include listing the machine's IP in<br>
/etc/hosts without the FQDN first; listing the machine's name on the<br>
localhost line in /etc/hosts; etc.<br>
<br>
Not listing the machine's name in /etc/hosts at all while correctly<br>
configuring DNS will tend to work correctly.<br>
<br>
<br>
</font>
<br>
<br>
<br>