Kerberos V5 is an authentication system developed at MIT.
Abridged from the User Guide:
Under Kerberos, a client sends a request for a ticket to the
Key Distribution Center (KDC). The KDC creates a ticket-granting
ticket (TGT) for the client, encrypts it using the client's
password as the key, and sends the encrypted TGT back to the
client. The client then attempts to decrypt the TGT, using
its password. If the client successfully decrypts the TGT, it
keeps the decrypted TGT, which indicates proof of the client's
identity. The TGT permits the client to obtain additional tickets,
which give permission for specific services.
Since Kerberos negotiates authenticated, and optionally encrypted,
communications between two points anywhere on the internet, it
provides a layer of security that is not dependent on which side of a
firewall either client is on.
The Kerberos V5 package is designed to be easy to use. Most of the
commands are nearly identical to UNIX network programs you are already
used to. Kerberos V5 is a single-sign-on system, which means that you
have to type your password only once per session, and Kerberos does
the authenticating and encrypting transparently.
Jacques Vidrine <n@nectar.com>
===> The following configuration options are available for krb5-121-1.21.2:
DNS_FOR_REALM=off: Enable DNS lookups for Kerberos realm names
EXAMPLES=on: Build and/or install examples
KRB5_HTML=on: Install krb5 HTML documentation
KRB5_PDF=on: Install krb5 PDF documentation
LDAP=off: LDAP protocol support
LMDB=off: OpenLDAP Lightning Memory-Mapped Database support
NLS=on: Native Language Support
====> Command line editing for kadmin and ktutil: you can only select none or one of them
READLINE=on: Command line editing via libreadline
LIBEDIT=off: Command line editing via libedit
LIBEDIT_BASE=off: Use libedit in FreeBSD base
===> Use 'make config' to modify these settings
security/krb5-121: Update to 1.21.2
Major changes in 1.21.2 (2023-08-14)
====================================
This is a bug fix release.
* Fix double-free in KDC TGS processing [CVE-2023-39975].
MFH: 2023Q3
(cherry picked from commit 8522ddedb83d4815964c9d2b4121980b187f4c53)
security/krb5-121: Fix double-free in KDC TGS processing
Upstream's commit log message:
When issuing a ticket for a TGS renew or validate request, copy only
the server field from the outer part of the header ticket to the new
ticket. Copying the whole structure causes the enc_part pointer to be
aliased to the header ticket until krb5_encrypt_tkt_part() is called,
resulting in a double-free if handle_authdata() fails.
[ghudson@mit.edu: changed the fix to avoid aliasing enc_part rather
than check for aliasing before freeing; rewrote commit message]
CVE-2023-39975:
(Only the first 15 lines of the commit message are shown above )
security/krb5: Support libedit in base
Even though libedit is in base FreeBSD, the krb5 ports still depend
on devel/libedit when the LIBEDIT option is selected. This is because
./configure uses pkgconf to determine if libedit exists, ignoring
libedit in FreeBSD base. This patch adds a new LIBEDIT_BASE option
which enables LIBEDIT (LIBEDIT_BASE) without installing the
devel/libedit port.
The GNU READLINE option will remain the default for now but it is
planned to switch the default to LIBEDIT_BASE at some point. This is
to reduce the dependency on GNU software and to bring it more into
line with the planned MIT KRB5 import into FreeBSD base.
(cherry picked from commit e89f84156a8fcb2f81c1f962845f4456b2f62f63)
security/krb5*: Disable NLS when option is deselected
When the NLS option is deselected, ./configure reverts to
enable_nls=check. As some prerequisites do require NLS, NLS is
always enabled even when deslected. This ensures that when NLS
is not wanted, that it is not used, regardless of its install status.
(cherry picked from commit 0b58b7b475e3100adfb3b532f2dfb9505e79bf83)
