krb5

[Greg Hudson]

On 10/17/2017 06:04 PM, Earl Killian wrote:
> However, I would like to inquire
> of the mailing list how things are supposed to work when those are set
> to false as in the openSUSE distro.

Not as easily as I would like.  For the specific issue you mention, I
think the only two workarounds are:

1. Create a principal "host/alpha" and put it in keytabs and ACL files
alongside "host/alpha.killian.com".

2. Arrange for gethostname() to return the FQDN (alpha.killian.com)
instead of just "alpha".  This might have undesirable side effects as it
would be a system-wide change.

POSIX does not make it easy to get this right without risking using
insecure DNS, although there are some improvements we could make (such
as looking to see if there is exactly one search domain in _res.dnsrch,
and expanding single-component hostnames using that domain if so).