addprinc -randkey broken in 1.7?

[Mike Friedman]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, 16 Sep 2009 at 13:13 (-0700), Russ Allbery wrote:

> "Leonard J. Peirce" <leonard.peirce at gmail.com> writes:
>
>> When running (in kadmin)
>
>>   addprinc -randkey host/host.domain
>
>> I get a complaint about the password not containing enough character 
>> classes.  Did I miss something?  Not really a big deal since I can just 
>> specify a password.
>
>> It used to work in 1.6.
>
> addprinc -randkey hasn't worked for principals that have a password 
> policy set for somet time for me.  The way -randkey works under the hood 
> is that it adds the principal disabled with a fixed password (which is 
> indeed pretty bad except that it's very long), then randomizes the key, 
> and then enables the principal.

Russ,

I'm running 1.6.3 and don't have this problem.  In fact, looking at the 
code in src/kadmin/cli/kadmin.c, it appears that when '-randkey' is used 
for addprinc, the password is set initially to a 256 character string 
containing all possible character values from 1 thru 255 plus a 
terminating 0 (and then randomized in a separate step).  This, I would 
think, should satisfy any password policy.

OK, so maybe I'm misinterpreting the code.  But the fact is that I add 
host principals with -randkey all the time with no problem.  I've been 
doing this for several releases up to and including our current 1.6.3. 
We may go to 1.7 soon, so possibly something's changed there, but in the 
meantime, could someone clarify all this?

Thanks.

_________________________________________________________________________
Mike Friedman                        Information Services & Technology
mikef at berkeley.edu                   2484 Shattuck Avenue
1-510-642-1410                       University of California at Berkeley
http://mikef.berkeley.edu            http://ist.berkeley.edu
_________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (FreeBSD)

iEYEARECAAYFAkqxaSkACgkQFgKSfLOvZ1R4AQCfXFXtJkRSnWJ674knaWY9lwep
v4QAnjeWdiKCZmF3U84Jvc5hcQpLU2px
=FcNU
-----END PGP SIGNATURE-----