addprinc -randkey broken in 1.7?
mikef at berkeley.edu
Wed Sep 16 18:39:37 EDT 2009
-----BEGIN PGP SIGNED MESSAGE-----
On Wed, 16 Sep 2009 at 13:13 (-0700), Russ Allbery wrote:
> "Leonard J. Peirce" <leonard.peirce at gmail.com> writes:
>> When running (in kadmin)
>> addprinc -randkey host/host.domain
>> I get a complaint about the password not containing enough character
>> classes. Did I miss something? Not really a big deal since I can just
>> specify a password.
>> It used to work in 1.6.
> addprinc -randkey hasn't worked for principals that have a password
> policy set for somet time for me. The way -randkey works under the hood
> is that it adds the principal disabled with a fixed password (which is
> indeed pretty bad except that it's very long), then randomizes the key,
> and then enables the principal.
I'm running 1.6.3 and don't have this problem. In fact, looking at the
code in src/kadmin/cli/kadmin.c, it appears that when '-randkey' is used
for addprinc, the password is set initially to a 256 character string
containing all possible character values from 1 thru 255 plus a
terminating 0 (and then randomized in a separate step). This, I would
think, should satisfy any password policy.
OK, so maybe I'm misinterpreting the code. But the fact is that I add
host principals with -randkey all the time with no problem. I've been
doing this for several releases up to and including our current 1.6.3.
We may go to 1.7 soon, so possibly something's changed there, but in the
meantime, could someone clarify all this?
Mike Friedman Information Services & Technology
mikef at berkeley.edu 2484 Shattuck Avenue
1-510-642-1410 University of California at Berkeley
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (FreeBSD)
-----END PGP SIGNATURE-----
More information about the Kerberos