ssh to IP literal

Greg Hudson ghudson at MIT.EDU
Mon Dec 20 00:02:40 EST 2010


On Sun, 2010-12-19 at 14:36 -0500, Russ Allbery wrote:
> It uses whatever one the client uses, in general.

Actually, as of MIT krb5 1.7, we usually ignore the principal sent by
the client, because it might be an alias.  If the server application
doesn't specify a principal, we just try every entry in the keytab until
we find one which can decrypt the ticket.

(The exception is when we're using a keytab with no iterator methods,
such as the KDB keytab.)

> There are some services
> that limit what principals they'll accept to only that one principal that
> matches what the service thinks is the local hostname, but given how many
> problems this causes, an increasing number of services will accept any
> principal found in the system keytab.

This is still true.





More information about the Kerberos mailing list