Question about dns_lookup_realm and domain_realm

[Jos Backus]

On Fri, Jun 27, 2008 at 01:57:37AM -0400, Jeffrey Altman wrote:
> There are several issues here.  First, DNS TXT records are known to be 
> insecure.  Turning
> them on for use in realm resolution provides for convenience but at the 
> risk that your clients
> can be redirected to a realm that you do not control.
 
Understood.

> Second, any domain_realm mapping for your domain .foo.com is going to 
> override the use
> of DNS lookups.  That is because local configuration data is considered 
> to be trustworthy
> whereas DNS lookups are not.
 
That's something my patch changes as it performs the DNS lookup first (when
configured).

> In the case of two realms, PROD.FOO.COM and DEV.FOO.COM some of your 
> hosts are
> in one and some are in the other.   By default you want PROD.FOO.COM to 
> be used.
> However, for specific hosts you want DEV.FOO.COM.    Using the config 
> file you would
> specify
> 
> [domain_realm]
>   devhost1.foo.com = DEV.FOO.COM
>   .foo.com = PROD.FOO.COM

Yup, tried that, works, but doesn't scale well.

> If you want to rely on DNS TXT records you have to make sure that there 
> are no mappings
> in the config file.  Then you would create records for
> 
>   _kerberos.devhost1.foo.com IN TXT DEV.FOO.COM
>   _kerberos.foo.com IN TXT PROD.FOO.COM

Okay. We have the former (obviously) but not the latter. I can add that.

> Because DNS TXT records are insecure and there is a need to be able to 
> provide for centralized
> configuration data Microsoft created the Kerberos referrals mechanism.  
> Using referrals a client
> asks the KDC belonging to the TGT realm for a referral to the correct 
> realm for the desired
> service principal.  Referrals are used whenever there is not a local 
> [domain_realm] mapping.
 
So this implies two-way trust and communication, yes? I wonder if this will
require network/ACL changes.

> The safe way to add DNS TXT records back into the equation would be to 
> add the DNS TXT
> lookup after the referrals request fails.

ISTR that's where krb5_get_fallback_host_realm() is called, from a comment in
the code. Now it's clear why although I still don't quite grok the referral
mechanism. Time to study the documentation.

Thanks for the critique and helpful information, Jeffrey.

-- 
Jos Backus
jos at catnook.com