Kerberos V5 is an authentication system developed at MIT.
Abridged from the User Guide:
Under Kerberos, a client sends a request for a ticket to the
Key Distribution Center (KDC). The KDC creates a ticket-granting
ticket (TGT) for the client, encrypts it using the client's
password as the key, and sends the encrypted TGT back to the
client. The client then attempts to decrypt the TGT, using
its password. If the client successfully decrypts the TGT, it
keeps the decrypted TGT, which indicates proof of the client's
identity. The TGT permits the client to obtain additional tickets,
which give permission for specific services.
Since Kerberos negotiates authenticated, and optionally encrypted,
communications between two points anywhere on the internet, it
provides a layer of security that is not dependent on which side of a
firewall either client is on.
The Kerberos V5 package is designed to be easy to use. Most of the
commands are nearly identical to UNIX network programs you are already
used to. Kerberos V5 is a single-sign-on system, which means that you
have to type your password only once per session, and Kerberos does
the authenticating and encrypting transparently.
Jacques Vidrine <n@nectar.com>
===> The following configuration options are available for krb5-1.22.3:
DNS_FOR_REALM=off: Enable DNS lookups for Kerberos realm names
DOCS=on: Build and/or install documentation
EXAMPLES=on: Build and/or install examples
LDAP=off: LDAP protocol support
LMDB=off: OpenLDAP Lightning Memory-Mapped Database support
NLS=on: Native Language Support
====> Command line editing for kadmin and ktutil: you can only select none or one of them
READLINE=on: Command line editing via libreadline
LIBEDIT=off: Command line editing via libedit
LIBEDIT_BASE=off: Use libedit in FreeBSD base
====> Options available for the radio CRYPTO: you can only select none or one of them
CRYPTO_BUILTIN=on: Use crypto built into KRB5
CRYPTO_OPENSSL=off: Use OpenSSL crypto
===> Use 'make config' to modify these settings
security/krb5*: Flavorize with default and ldap flavors
This provides a binary package to users who require MIT KRB5 with LDAP
support. This patch does not change the current, now default, package
name.
PR: 277015
security/krb5-120: Welcome new krb5 1.20
Welcome the new krb5-120 (1.20) from MIT.
krb5-118 is now deprecated and scheduled for removal a year from
now.
security/sssd: Fix package with SMB=on
While here, add comment in security/krb5 to remember the obscure dependency in
security/sssd so it does not break again.
PR: 244778
Reported by: tommyhp2@gmail.com
Tested by: tommyhp2@gmail.com
MFH: 2021Q2 (build fix)
Welcome the new KRB5 1.19 (krb5-119)
In addition, deprecate krb5-117 to retire one year after the release
of krb5-119: Feb 1, 2022.
krb5-119 becomes the default krb5 port.
Welcome the new KRB5 1.18 (krb5-118)
In addition, deprecate krb5-116 to retire one year after the release
of krb5-118: Feb 12, 2021.
Major changes in 1.18 (2020-02-12)
==================================
Administrator experience:
* Remove support for single-DES encryption types.
* Change the replay cache format to be more efficient and robust.
Replay cache filenames using the new format end with ".rcache2" by
default.
(Only the first 15 lines of the commit message are shown above )
Welcome the new KRB5 1.17 (krb5-117).
Major changes in 1.17 (2019-01-08)
==================================
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
(Only the first 15 lines of the commit message are shown above )
Welcome the new security/krb5-116 port. This port follows MIT's
KRB5 1.16 releases.
Major changes in 1.16 (2017-12-05)
==================================
Administrator experience:
* The KDC can match PKINIT client certificates against the
"pkinit_cert_match" string attribute on the client principal entry,
using the same syntax as the existing "pkinit_cert_match" profile
option.
* The ktutil addent command supports the "-k 0" option to ignore the
key version, and the "-s" option to use a non-default salt string.
(Only the first 15 lines of the commit message are shown above )
Welcome the new security/krb5-115 port. This port follows MIT's
KRB5 1.15 releases.
To support this new ports:
- The security/krb5 port includes an option to use this port instead
of krb5-114 as its base. krb5-114 will remain the default until the
next release of KRB5 1.15 (if it's stable of course).
- MIT by default deprecates KRB5 two versions back from the current
release. krb5-113 has been deprecated and will expire one year from
now.
This is the second part of two commits, the first being r403749.
Adopt the same port structure as used by the cfengine family of ports:
security/krb5 is renamed to security/krb5-114.
A brand new security/krb5 now becomes a master port for the family of
security/krb5-* ports. The default installs krb5-1.14. There is no
functional change to the port build nor does the name of the latest krb5
port and package change. Users can continue to install security/krb5
to track the latest major version of security/krb5.
Users wishing to install a specific version branch of krb5 can continue
to install any of the security/krb5-* ports or by setting KRB5_VERSION
in make.conf make.conf or including the branch on the make command line
during build:
make KRB5_VERSIN=NNN
make -V VERSIONS lists available versions.
security/krb5-appl has been updated to support this change (also fixing
a typo in the krb5-appl/Makefile).
Inspired by: sysutils/cfengine
Introduce the new krb5 1.14:
- move (copy) krb5 (krb5 1.13.2) to krb5-113 (new, added)
- update krb5 1.13.2 --> 1.14
- update CONFLICTS in krb5, krb5-112 and krb5-113.
- update krb5-appl to allow optional dependency on krb5-113.
- update security/Makefile with copied krb5-113.
- deprecate and expire krb5-112 (krb5-1.12) on November 20, 2016, as it
will EOL twelve months after the release of krb5-1.14.
Fix build under 11-CURRENT. r378417 introduced a libreadline link
workaround due to libtool not working with 11-CURRENT at the time.
The workaround now causes grief under 11-CURRENT and needs to be
removed.
PR: 202782
- Display a stage-qa warning when ports use PREFIX/var instead of /var
- Add --localstatedir=/var to _LATE_CONFIGURE_ARGS (like --mandir) but not
when CONFIGURE_ARGS already sets it. (GNU configure scripts set it to
PREFIX/var when PREFIX != /usr.)
- Add --localstatedir="${PREFIX}/var" to CONFIGURE_ARGS in some ports so
they aren't affected by this change (for now at least). This commit is
meant to ensure that new ports don't make the same mistake.
- games/acm: the configure script in this port is very old; instead of
patching it more, just replace GNU_CONFIGURE with HAS_CONFIGURE.
- irc/charybdis: it already used /var but adding --localstatedir=/var
changed the behaviour of the configure script; adjust the port to this.
PR: 199506
Exp-run by: antoine
Approved by: portmgr (antoine)
Correct various packaging issues:
- Libraries are not installed stripped;
- pkgconfig files should be installed to libdata;
- Use of deprecated @dirrm[try]
PR: PR/197338
Submitted by: delphij
- Remove support for EXTRACT_PRESERVE_OWNERSHIP
- Update a few comments related to extract
Differential Revision: https://reviews.freebsd.org/D1189
With hat: portmgr
MIT Kerberos released 1.13; 1.12 becomes a maintenance release,
1.11 remains a maintenance release.
- Update security/krb5 1.12.2 --> 1.13
- Copy the old security/krb5 1.12.2 to security/krb5-112
(now a maintenance release supported by MIT)
- Move the old krb5-maint (1.11.5: old maintenance release) to
security/krb5-111 (the old maintenance release still supported by MIT)
net/openldap24-*:
- Convert to USES=libtool and bump dependent ports
- Avoid USE_AUTOTOOLS
- Don't use PTHREAD_LIBS
- Use MAKE_CMD
databases/glom:
- Drop :keepla
- Add INSTALL_TARGET=install-strip
databases/libgda4* databases/libgda5*:
- Convert to USES=libtool and bump dependent ports
- USES=tar:xz
- Use INSTALL_TARGET=install-strip
- Use @sample
(Only the first 15 lines of the commit message are shown above )
1. Fix build when using clang 3.4.
2. RTM_OLDADD and RTM_OLDDEL were removed from -stable. Thanks alfred@ for
this patch.
3. Stagify.
Submitted by: alfred (#2)
Update krb5 to 1.12. Security/krb5 tracks MIT KRB5 current release.
Adjust the newly created krb5-maint with a new portname and conflicts.
Krb5-maint is a maintenance release for those who wish to use the previous
release of krb5. krb5-maint remains at 1.11.3.
Adjust CONFLICTS in security/heimdal and security/srp to account for the
newly repocopied krb5-maint.
Adjust security/Makefile to include krb5-maint.
Update krb5 1.11.2 --> 1.11.3.
This is a bugfix release.
* Fix a UDP ping-pong vulnerability in the kpasswd (password changing)
service. [CVE-2002-2443]
* Improve interoperability with some Windows native PKINIT clients.
Security: CVE-2002-2443
Update 1.11.1 --> 1.11.2
Major changes in 1.11.2 (2013-04-12)
====================================
This is a bugfix release.
* Incremental propagation could erroneously act as if a slave's
database were current after the slave received a full dump that
failed to load.
* gss_import_sec_context incorrectly set internal state that
identifies whether an imported context is from an interposer
mechanism or from the underlying mechanism.
Feature safe: yes
Fix verto.h missing build error on some systems.
The following contributed by mandree@:
- Header standardization.
- Make use of OptionsNG.
- Make portlint happy.
- pointyhat kludge - tetex drags in port-OpenSSL on 7.X, but only as a build
dependency. Yet this triggers autodetection code in bsd.openssl.mk and
OpenSSL dependency is registered with the resulting package, creating a
discord between INDEX and actual package. Work around by explicitly recording
the dependency in a way that INDEX build will see.
OK'ed by: cy (maintainer)
Feature safe: yes
Apply patch from MIT KRB5 GIT tree commit: 043533c2f13d2bc69316.
libgssrpc was ignorant of the remote address of the kadmin socket,
even when it's IPv4. This made old-style GSSAPI authentication fail
because it uses the wrong channel bindings. Fix this problem by making
clnttcp_create() get the remote address from the socket using getpeername()
if the caller doesn't provide it and it's an IPv4 address.
PR: 160500
Submitted by: Ben Kaduk <kaduk@mit.edu>
Apply fixes for kpropd denial of service (MITKRB5-SA-2011-001) and KDC
denial of service (MITKRB5-SA-2011-002).
Security: MITKRB5-SA-2011-001 (CVE-2010-4022),
MITKRB5-SA-2011-002 (CVE-2011-0281)
-Repocopy devel/libtool15 -> libtool22 and libltdl15 -> libltdl22.
-Update libtool and libltdl to 2.2.6a.
-Remove devel/libtool15 and devel/libltdl15.
-Fix ports build with libtool22/libltdl22.
-Bump ports that depend on libltdl22 due to shared library version change.
-Explain what to do update in the UPDATING.
It has been tested with GNOME2, XFCE4, KDE3, KDE4 and other many wm/desktop
and applications in the runtime.
With help: marcus and kwm
Pointyhat-exp: a few times by pav
Tested by: pgollucci, "Romain Tartière" <romain@blogreen.org>, and
a few MarcusCom CVS users. Also, I might have missed a few.
Repocopy by: marcus
Approved by: portmgr
