Kerberos V5 is an authentication system developed at MIT.
WWW: http://web.mit.edu/kerberos/
Abridged from the User Guide:
Under Kerberos, a client sends a request for a ticket to the
Key Distribution Center (KDC). The KDC creates a ticket-granting
ticket (TGT) for the client, encrypts it using the client's
password as the key, and sends the encrypted TGT back to the
client. The client then attempts to decrypt the TGT, using
its password. If the client successfully decrypts the TGT, it
keeps the decrypted TGT, which indicates proof of the client's
identity. The TGT permits the client to obtain additional tickets,
which give permission for specific services.
Since Kerberos negotiates authenticated, and optionally encrypted,
communications between two points anywhere on the internet, it
provides a layer of security that is not dependent on which side of a
firewall either client is on.
The Kerberos V5 package is designed to be easy to use. Most of the
commands are nearly identical to UNIX network programs you are already
used to. Kerberos V5 is a single-sign-on system, which means that you
have to type your password only once per session, and Kerberos does
the authenticating and encrypting transparently.
Jacques Vidrine <n@nectar.com>
===> The following configuration options are available for krb5-113-1.13.7_8:
DNS_FOR_REALM=off: Enable DNS lookups for Kerberos realm names
EXAMPLES=on: Build and/or install examples
KRB5_HTML=on: Install krb5 HTML documentation
KRB5_PDF=on: Install krb5 PDF documentation
LDAP=off: LDAP protocol support
NLS=on: Native Language Support
====> Command line editing for kadmin and ktutil: you can only select none or one of them
READLINE=on: Command line editing via libreadline
READLINE_PORT=off: Command line editing via devel/readline
LIBEDIT=off: Command line editing via libedit
===> Use 'make config' to modify these settings
Reconcile e2fsprogs ./. krb5-* conflicts.
* Move conflicting e2fsprogs headers & libs into .../e2fsprogs/... subdirs.
* Move conflicting awk scripts into ${DATADIR}.
* Rename and patch compile_et to e2fsprogs-compile_et.
* Remove conflict markers (from e2fsprogs and krb5-*).
* Add CPPFLAGS/LDFLAGS to sysutils/fusefs-ext2, including
--rpath setting.
While here, also:
* sort pkg-plist and files/unwanted
* use FUSEFS_CONFIGURE_ENABLE=fuse2fs to prevent e2fsprogs from picking up
fusefs (implies --disable-fuse2fs if the option remains disabled)
* add --without-included-gettext to CONFIGURE_ARGS just to be on the safe
side.
And of course, bump PORTREVISION to 3 in e2fsprogs. Since other ports
do not change files or runtime behaviour, their PORTREVISION remains
untouched.
New READLINE_PORT option to select to use readline in base or
readline in ports.
PR: 217552
Submitted by: John W. O'brien <john@saltant.com>
Differential Revision: D9889
Remove redundant file that should have been removed in r253265.
PR: 217552
Submitted by: John W. O'brien <john@saltant.com>
Differential Revision: D9889
Remove redundant message about Kerberos klogind and telnetd. These
programs ere moved to krb5-appl (by MIT) when krb5-appl was created
in r253265. This message should have been removed from this Makefile
at that time.
Pointy hat to: cy (that's me)
Welcome the new security/krb5-115 port. This port follows MIT's
KRB5 1.15 releases.
To support this new ports:
- The security/krb5 port includes an option to use this port instead
of krb5-114 as its base. krb5-114 will remain the default until the
next release of KRB5 1.15 (if it's stable of course).
- MIT by default deprecates KRB5 two versions back from the current
release. krb5-113 has been deprecated and will expire one year from
now.
Update to 1.13.6.
This is a bug fix release.
* Improve some error messages
* Improve documentation
* Allow a principal with nonexistent policy to bypass the minimum
password lifetime check, consistent with other aspects of
nonexistent policies
* Fix a rare KDC denial of service vulnerability when anonymous client
principals are restricted to obtaining TGTs only [CVE-2016-3120]
MFH: 2016Q3
Security: 62d45229-4fa0-11e6-9d13-206a8a720317
Security: CVE-2016-3120
This is the second part of two commits, the first being r403749.
Adopt the same port structure as used by the cfengine family of ports:
security/krb5 is renamed to security/krb5-114.
A brand new security/krb5 now becomes a master port for the family of
security/krb5-* ports. The default installs krb5-1.14. There is no
functional change to the port build nor does the name of the latest krb5
port and package change. Users can continue to install security/krb5
to track the latest major version of security/krb5.
Users wishing to install a specific version branch of krb5 can continue
to install any of the security/krb5-* ports or by setting KRB5_VERSION
in make.conf make.conf or including the branch on the make command line
during build:
make KRB5_VERSIN=NNN
make -V VERSIONS lists available versions.
security/krb5-appl has been updated to support this change (also fixing
a typo in the krb5-appl/Makefile).
Inspired by: sysutils/cfengine
Introduce the new krb5 1.14:
- move (copy) krb5 (krb5 1.13.2) to krb5-113 (new, added)
- update krb5 1.13.2 --> 1.14
- update CONFLICTS in krb5, krb5-112 and krb5-113.
- update krb5-appl to allow optional dependency on krb5-113.
- update security/Makefile with copied krb5-113.
- deprecate and expire krb5-112 (krb5-1.12) on November 20, 2016, as it
will EOL twelve months after the release of krb5-1.14.
