On Sep 11, 2008, at 13:03, Victor Sudakov wrote:
> Colleagues,
>
> Is there a way to configure a Kerberos client to use TCP for obtaining
> tickets, other that explicitly listing all KDC's in krb5.conf with
> the "tcp" prefix?
>
> I want to be able to prefer TCP transport and still retain the
> possibility of using DNS SRV records to lookup KDCs.

The setting "udp_preference_limit" (under libdefaults) indicates the
minimum outgoing packet size for which the library will try TCP
first. If it doesn't get through with TCP, it will still try UDP;
this only controls the order.

Ken

Ken Raeburn wrote:
> >
> > Is there a way to configure a Kerberos client to use TCP for obtaining
> > tickets, other that explicitly listing all KDC's in krb5.conf with
> > the "tcp" prefix?
> >
> > I want to be able to prefer TCP transport and still retain the
> > possibility of using DNS SRV records to lookup KDCs.

> The setting "udp_preference_limit" (under libdefaults) indicates the
> minimum outgoing packet size for which the library will try TCP
> first. If it doesn't get through with TCP, it will still try UDP;
> this only controls the order.

Sorry, I did not mention I was talking about Heimdal.

--
Victor Sudakov, VAS4-RIPE, VAS47-RIPN
2:5005/49@fidonet http://vas.tomsk.ru/

12 sep 2008 kl. 09.59 skrev Victor Sudakov:

>>> Is there a way to configure a Kerberos client to use TCP for
>>> obtaining
>>> tickets, other that explicitly listing all KDC's in krb5.conf with
>>> the "tcp" prefix?
>>>

Default protocol in Heimdal is udp, there is no way other then you
described to override it.

What problem do you have that require tcp ?

Love

Love H?rnquist ?strand wrote:

> >>> Is there a way to configure a Kerberos client to use TCP for
> >>> obtaining
> >>> tickets, other that explicitly listing all KDC's in krb5.conf with
> >>> the "tcp" prefix?
> >>>

> Default protocol in Heimdal is udp, there is no way other then you
> described to override it.

> What problem do you have that require tcp ?

The problem is with a Heimdal client and Microsoft KDC:

$ kinit sudakovva@SIBPTUS.TRANSNEFT.RU
sudakovva@SIBPTUS.TRANSNEFT.RU's Password:
kinit: krb5_get_init_creds: Response too big for UDP, retry with TCP
$

--
Victor Sudakov, VAS4-RIPE, VAS47-RIPN
2:5005/49@fidonet http://vas.tomsk.ru/

> The problem is with a Heimdal client and Microsoft KDC:
>
> $ kinit sudakovva@SIBPTUS.TRANSNEFT.RU
> sudakovva@SIBPTUS.TRANSNEFT.RU's Password:
> kinit: krb5_get_init_creds: Response too big for UDP, retry with TCP
> $

What version is this ? It should be fixed (again) in releases after
Jun 12 2007. Heimdal 1.1 for sure.

Love

Love H?rnquist ?strand wrote:
> > The problem is with a Heimdal client and Microsoft KDC:
> >
> > $ kinit sudakovva@SIBPTUS.TRANSNEFT.RU
> > sudakovva@SIBPTUS.TRANSNEFT.RU's Password:
> > kinit: krb5_get_init_creds: Response too big for UDP, retry with TCP
> > $

> What version is this ?

ws233# klist --version
klist (Heimdal 0.6.3)
Copyright 1999-2004 Kungliga Tekniska Högskolan
Send bug-reports to heimdal-bugs@pdc.kth.se
ws233# uname -sr
FreeBSD 7.0-RELEASE
ws233#


> It should be fixed (again) in releases after
> Jun 12 2007. Heimdal 1.1 for sure.

It is FreeBSD's stock Kerberos.
Can you give me the URL for the fix? I could submit a PR to the FreeBSD team.


--
Victor Sudakov, VAS4-RIPE, VAS47-RIPN
2:5005/49@fidonet http://vas.tomsk.ru/

13 sep 2008 kl. 07.57 skrev Victor Sudakov:

> Love H?rnquist ?strand wrote:
>>> The problem is with a Heimdal client and Microsoft KDC:
>>>
>>> $ kinit sudakovva@SIBPTUS.TRANSNEFT.RU
>>> sudakovva@SIBPTUS.TRANSNEFT.RU's Password:
>>> kinit: krb5_get_init_creds: Response too big for UDP, retry with TCP
>>> $
>
>> What version is this ?
>
> ws233# klist --version
> klist (Heimdal 0.6.3)

0.6.3 is very old.

> Copyright 1999-2004 Kungliga Tekniska Högskolan
> Send bug-reports to heimdal-bugs@pdc.kth.se
> ws233# uname -sr
> FreeBSD 7.0-RELEASE
> ws233#
>
>
>> It should be fixed (again) in releases after
>> Jun 12 2007. Heimdal 1.1 for sure.
>
> It is FreeBSD's stock Kerberos.
> Can you give me the URL for the fix? I could submit a PR to the
> FreeBSD team.
>

http://www.h5l.org/fisheye/browse/he...12897&r2=12930

Might be others too.

Love