Debian Bug report logs - #856307
krb5-user: kinit fails for OTP user when using kdc discovery via DNS

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Jochen Hein <jochen@jochen.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: krb5-user: kinit fails for OTP user when using kdc discovery via DNS

Date: Mon, 27 Feb 2017 14:56:41 +0100

Package: krb5-user
Version: 1.15-1
Severity: normal

Dear Maintainer,

I'm running two IPA servers for authentication and have enrolled a
Debian/testing host as a client in my IPA domain. Authentication with
kinit as normal user (password only) works fine [redacted/shortened
log]:

Passwort for user@EXAMPLE.ORG: 
[8356] 1488202583.504266: Preauth module encrypted_challenge (138) (real) returned: 0/Success
[8356] 1488202583.504305: Produced preauth for next request: 133, 138
[8356] 1488202583.504332: Encoding request body and padata into FAST request
[8356] 1488202583.504565: Sending request (1180 bytes) to EXAMPLE.ORG
[8356] 1488202583.506508: Resolving hostname freeipa1.example.org.
[8356] 1488202583.507624: Sending initial UDP request to dgram fd23:e163:19f7:1234:5054:ff:fe85:ba0d:88
[8356] 1488202583.672491: Received answer (1038 bytes) from dgram fd23:e163:19f7:1234:5054:ff:fe85:ba0d:88
[8356] 1488202583.673974: Response was from master KDC

When using the same /etc/krb5.conf and kinit with an OTP user I get:

[11894] 1488202850.383675: Encoding request body and padata into FAST request
[11894] 1488202850.383843: Sending request (1077 bytes) to EXAMPLE.ORG
[11894] 1488202850.385176: Resolving hostname freeipa2.example.org.
[11894] 1488202850.385782: Sending initial UDP request to dgram fd23:e163:19f7:1234:5054:ff:fe07:ff5a:88
[11894] 1488202850.387857: Received answer (546 bytes) from dgram fd23:e163:19f7:1234:5054:ff:fe07:ff5a:88
[11894] 1488202850.388696: Response was from master KDC
[11894] 1488202850.388761: Received error from KDC: -1765328359/zusätzlich Vorauthentifizierung erforderlich
[11894] 1488202850.388784: Decoding FAST response
[11894] 1488202850.388980: Processing preauth types: 136, 141, 133, 137
[11894] 1488202850.388998: Received cookie: MIT
Geben Sie den Wert des Einwegpasswort-Tokens an: 
[11894] 1488202860.437172: Preauth module otp (141) (real) returned: 0/Success
[11894] 1488202860.437196: Produced preauth for next request: 133, 142
[11894] 1488202860.437211: Encoding request body and padata into FAST request
[11894] 1488202860.437438: Sending request (1272 bytes) to EXAMPLE.ORG
[11894] 1488202860.440332: Resolving hostname freeipa2.example.org.
[11894] 1488202860.441738: Sending initial UDP request to dgram fd23:e163:19f7:1234:5054:ff:fe07:ff5a:88
[11894] 1488202861.442912: Sending initial UDP request to dgram 192.168.30.122:88
[11894] 1488202861.443663: Received answer (0 bytes) from dgram 192.168.30.122:88
[11894] 1488202861.464406: Response was from master KDC
[11894] 1488202861.464406: Response was from master KDC
[11894] 1488202861.464495: Processing preauth types: 136, 141, 133, 137
[11894] 1488202861.464521: Received cookie: MIT
kinit: allgemeiner Fehlschlag der Vorauthentifizierung bei Anfängliche Anmeldedaten werden geholt.


So we try multiple UDP requests, and finally fail.  I do have
"udp_preference_limit = 1" in /etc/krb5.conf to force TCP, but as we
see above, we use UDP.

So, bug number one seems to be that we use UDP instead of the wanted
TCP. And we try multiple KDCs, which is not useful fpr OTP, because
the token will be consumed and the second request will fail.

If I change my /etc/krb5.conf to (dns_lookup_kdc = false, kdc = freeipa1.example.org):

...
[libdefaults]
  default_realm = EXAMPLE.ORG
  dns_lookup_realm = true
  dns_lookup_kdc = false
  rdns = false
  ticket_lifetime = 24h
  forwardable = yes
  udp_preference_limit = 1
  default_ccache_name = KEYRING:persistent:%{uid}

[realms]
  EXAMPLE.ORG = {
    pkinit_anchors = FILE:/etc/ipa/ca.crt
    kdc = freeipa1.example.org
  }
...

authentication a an OTP user works as expected and we use TCP sessions:

[15302] 1488203143.7313: Resolving hostname freeipa1.example.org
[15302] 1488203143.8013: Initiating TCP connection to stream fd23:e163:19f7:1234:5054:ff:fe85:ba0d:88
[15302] 1488203143.8392: Sending TCP request to stream fd23:e163:19f7:1234:5054:ff:fe85:ba0d:88
[15302] 1488203143.10601: Received answer (544 bytes) from stream fd23:e163:19f7:1234:5054:ff:fe85:ba0d:88
[15302] 1488203143.10624: Terminating TCP connection to stream fd23:e163:19f7:1234:5054:ff:fe85:ba0d:88
[15302] 1488203143.10698: Response was not from master KDC
[15302] 1488203143.10745: Received error from KDC: -1765328359/zusätzlich Vorauthentifizierung erforderlich
[15302] 1488203143.10765: Decoding FAST response
[15302] 1488203143.10966: Processing preauth types: 136, 141, 133, 137
[15302] 1488203143.10988: Received cookie: MIT
Geben Sie den Wert des Einwegpasswort-Tokens an: 
[15302] 1488203153.599264: Preauth module otp (141) (real) returned: 0/Success
[15302] 1488203153.599305: Produced preauth for next request: 133, 142
[15302] 1488203153.599322: Encoding request body and padata into FAST request
[15302] 1488203153.599560: Sending request (1271 bytes) to EXAMPLE.ORG
[15302] 1488203153.599621: Resolving hostname freeipa1.example.org
[15302] 1488203153.600632: Initiating TCP connection to stream fd23:e163:19f7:1234:5054:ff:fe85:ba0d:88
[15302] 1488203153.600957: Sending TCP request to stream fd23:e163:19f7:1234:5054:ff:fe85:ba0d:88
[15302] 1488203155.236450: Received answer (1001 bytes) from stream fd23:e163:19f7:1234:5054:ff:fe85:ba0d:88
[15302] 1488203155.236497: Terminating TCP connection to stream fd23:e163:19f7:1234:5054:ff:fe85:ba0d:88
[15302] 1488203155.236643: Response was not from master KDC
[15302] 1488203155.236707: Decoding FAST response

How do I get OTP with "dns_lookup_kdc = true" to work? Why do we use
UDP instead of TCP when we use DNS-discovery?


-- System Information:
Debian Release: 9.0
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 4.9.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages krb5-user depends on:
ii  krb5-config         2.6
ii  libc6               2.24-9
ii  libcomerr2          1.43.4-2
ii  libgssapi-krb5-2    1.15-1
ii  libgssrpc4          1.15-1
ii  libk5crypto3        1.15-1
ii  libkadm5clnt-mit11  1.15-1
ii  libkadm5srv-mit11   1.15-1
ii  libkdb5-8           1.15-1
ii  libkeyutils1        1.5.9-9
ii  libkrb5-3           1.15-1
ii  libkrb5support0     1.15-1
ii  libss2              1.43.4-2

krb5-user recommends no packages.

krb5-user suggests no packages.

-- no debconf information

Message #10 received at submit@bugs.debian.org (full text, mbox, reply):

From: Sam Hartman <hartmans@debian.org>

To: Jochen Hein <jochen@jochen.org>

Cc: Debian Bug Tracking System <submit@bugs.debian.org>, 856307@bugs.debian.org

Subject: Re: Bug#856307: krb5-user: kinit fails for OTP user when using kdc discovery via DNS

Date: Mon, 27 Feb 2017 10:09:47 -0500

Do you have _kerberos._tcp DNS entries along with the _kerberos._udp
entries?
Does that help if not?

Message #20 received at submit@bugs.debian.org (full text, mbox, reply):

From: Jochen Hein <jochen@jochen.org>

To: Sam Hartman <hartmans@debian.org>

Cc: Debian Bug Tracking System <submit@bugs.debian.org>, 856307@bugs.debian.org

Subject: Re: Bug#856307: krb5-user: kinit fails for OTP user when using kdc discovery via DNS

Date: Mon, 27 Feb 2017 21:44:43 +0100

Oh, and kinit with _udp entries worked fine in stable with krb5-user
1.12.1+dfsg-19+deb8u2. And now seems to work without them too.

Jochen

-- 
The only problem with troubleshooting is that the trouble shoots back.

Message #25 received at 856307@bugs.debian.org (full text, mbox, reply):

From: Jochen Hein <jochen@jochen.org>

To: Sam Hartman <hartmans@debian.org>

Cc: 856307@bugs.debian.org

Subject: Re: Bug#856307: krb5-user: kinit fails for OTP user when using kdc discovery via DNS

Date: Mon, 27 Feb 2017 21:33:18 +0100

Sam Hartman <hartmans@debian.org> writes:

> Do you have _kerberos._tcp DNS entries along with the _kerberos._udp
> entries?

Yes, I do have them - they were created when I installed my IPA domain.

> Does that help if not?

Yes, that seems to work. Hm, my CentOS machine worked with these
entries, but I didn't see relevant config differences and browsing
through the source diff didn't help.

Do you think it will hurt to just leave the _kerberos._udp-entries
removed?  I'll just wait and see for now.

Thanks for your quick answer.

Jochen

-- 
The only problem with troubleshooting is that the trouble shoots back.

Message #35 received at 856307@bugs.debian.org (full text, mbox, reply):

From: Sam Hartman <hartmans@debian.org>

To: Jochen Hein <jochen@jochen.org>

Cc: 856307@bugs.debian.org

Subject: Re: Bug#856307: krb5-user: kinit fails for OTP user when using kdc discovery via DNS

Date: Mon, 27 Feb 2017 15:46:38 -0500

So, your experience is that with _kerberos._tcp entries but no
_kerberos._udp entries it works.

However, with _kerberos._udp and _kerberos._tcp entries both, it fails?
If so, that's a bug.
With modern (say post Windows XP), I'd imagine that TCP only will be
fine.
However, if adding the UDP entries causes a failure, I definitely should
work with upstream.

--Sam

Message #40 received at 856307@bugs.debian.org (full text, mbox, reply):

From: Jochen Hein <jochen@jochen.org>

To: Sam Hartman <hartmans@debian.org>

Cc: 856307@bugs.debian.org

Subject: Re: Bug#856307: krb5-user: kinit fails for OTP user when using kdc discovery via DNS

Date: Mon, 27 Feb 2017 22:00:26 +0100

Sam Hartman <hartmans@debian.org> writes:

> So, your experience is that with _kerberos._tcp entries but no
> _kerberos._udp entries it works.

Yes.

> However, with _kerberos._udp and _kerberos._tcp entries both, it fails?

Yes, it fails (in Testing, but not in Stable)

> However, if adding the UDP entries causes a failure, I definitely should
> work with upstream.

Thanks.

Jochen

-- 
The only problem with troubleshooting is that the trouble shoots back.

Message #45 received at 856307@bugs.debian.org (full text, mbox, reply):

From: Greg Hudson <ghudson@mit.edu>

To: 856307@bugs.debian.org

Subject: Re: krb5-user: kinit fails for OTP user when using kdc discovery via DNS

Date: Tue, 28 Feb 2017 14:06:53 -0500

Upstream issue entry: http://krbdev.mit.edu/rt/Ticket/Display.html?id=8554
Upstream fix:
  https://github.com/krb5/krb5/commit/bc7594058011c2f9711f24af4fa15a421a8d5b62

This bug will also be fixed in the krb5 1.15.1 and krb5 1.14.5 patch
releases.

Message #50 received at 856307@bugs.debian.org (full text, mbox, reply):

From: Jochen Hein <jochen@jochen.org>

To: Greg Hudson <ghudson@mit.edu>

Cc: 856307@bugs.debian.org,Sam Hartman <hartmans@debian.org>

Subject: Re: krb5-user: kinit fails for OTP user when using kdc discovery via DNS

Date: Wed, 01 Mar 2017 20:14:47 +0100

Hello Greg,

> Upstream fix:
>  https://github.com/krb5/krb5/commit/bc7594058011c2f9711f24af4fa15a421a8d5b62

I've recompiled the Debian package with your patch and can confirm that
it works for me.  Thanks for the quick fix.

> This bug will also be fixed in the krb5 1.15.1 and krb5 1.14.5 patch
> releases.

Wonderful.

Jochen

Message #55 received at 856307@bugs.debian.org (full text, mbox, reply):

From: Jochen Hein <jochen@jochen.org>

To: Debian Bug Tracking System <856307@bugs.debian.org>

Subject: Re: krb5-user: kinit fails for OTP user when using kdc discovery via DNS

Date: Mon, 17 Apr 2017 07:56:52 +0200

Package: krb5-user
Followup-For: Bug #856307

Dear Maintainer,

I see that in the meantime krb5-1.15.1 has been releases upstream.  My
guess would be, that we can't get the fix/upstream release in the (now
frozen) stretch release.

Do you think it would be possible to get 1.15.1 in a point release to
stretch?

Thanks
Jochen

Message #60 received at 856307@bugs.debian.org (full text, mbox, reply):

From: Sam Hartman <hartmans@debian.org>

To: Jochen Hein <jochen@jochen.org>

Cc: Debian Bug Tracking System <856307@bugs.debian.org>

Subject: Re: Bug#856307: krb5-user: kinit fails for OTP user when using kdc discovery via DNS

Date: Mon, 17 Apr 2017 12:39:11 -0400

It's almost certainly impossible to get 1.15.1 into a point release of
stretch.
I think though the interesting question is whether this fix should go
into stretch.
In general, only important or release critical fixes  can be included
after the freeze.
When you filed this bug as normal rather than important, I assumed you
were saying that when you considered the severity it really met the
criteria for important severity.
I was on the fence about the issue, and decided to take your lead.
Without real users actually claiming the issue met the criteria for
important, I wasn't going to push for it or do the work to prepare a fix
for stretch.


So, how big of a deal is this for you and your organization?  How easy
is the work around of not relying on DNS to deploy?

Message #65 received at 856307@bugs.debian.org (full text, mbox, reply):

From: Jochen Hein <jochen@jochen.org>

To: Sam Hartman <hartmans@debian.org>

Cc: Debian Bug Tracking System <856307@bugs.debian.org>

Subject: Re: Bug#856307: krb5-user: kinit fails for OTP user when using kdc discovery via DNS

Date: Mon, 17 Apr 2017 21:30:22 +0200

Sam Hartman <hartmans@debian.org> writes:

> It's almost certainly impossible to get 1.15.1 into a point release of
> stretch.

That's also my guess.

> When you filed this bug as normal rather than important, I assumed you
> were saying that when you considered the severity it really met the
> criteria for important severity.
> I was on the fence about the issue, and decided to take your lead.
> Without real users actually claiming the issue met the criteria for
> important, I wasn't going to push for it or do the work to prepare a fix
> for stretch.

That's fine for me.  It only manifests for OTP users which seems to be
new and until now not often used.

> So, how big of a deal is this for you and your organization?  How easy
> is the work around of not relying on DNS to deploy?

Not a really big deal. I've prepared a local package and will deploy it
to the debian servers I have.  Ubuntu (LTS) is used on the
Laptops/Workstation, but I'll walk the same path when needed.  We talk
about 12-15 machine - so no big deal.

Jochen

-- 
This space is intentionally left blank.

Message #70 received at 856307@bugs.debian.org (full text, mbox, reply):

From: Sam Hartman <hartmans@debian.org>

To: Jochen Hein <jochen@jochen.org>

Cc: 856307@bugs.debian.org

Subject: Re: Bug#856307: krb5-user: kinit fails for OTP user when using kdc discovery via DNS

Date: Mon, 17 Apr 2017 15:42:13 -0400

OK.
OK.
If a couple of folks indicate this is an issue for them then it's a
simple enough fix it could be uploaded during the stretch lifecycle.

Message #75 received at 856307-close@bugs.debian.org (full text, mbox, reply):

From: Sam Hartman <hartmans@debian.org>

To: 856307-close@bugs.debian.org

Subject: Bug#856307: fixed in krb5 1.15-2

Date: Fri, 21 Apr 2017 02:49:37 +0000

Source: krb5
Source-Version: 1.15-2

We believe that the bug you reported is fixed in the latest version of
krb5, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 856307@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sam Hartman <hartmans@debian.org> (supplier of updated krb5 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Wed, 19 Apr 2017 16:50:01 -0400
Source: krb5
Binary: krb5-user krb5-kdc krb5-kdc-ldap krb5-admin-server krb5-kpropd krb5-multidev libkrb5-dev libkrb5-dbg krb5-pkinit krb5-otp krb5-k5tls krb5-doc libkrb5-3 libgssapi-krb5-2 libgssrpc4 libkadm5srv-mit11 libkadm5clnt-mit11 libk5crypto3 libkdb5-8 libkrb5support0 libkrad0 krb5-gss-samples krb5-locales libkrad-dev
Architecture: source amd64 all
Version: 1.15-2
Distribution: experimental
Urgency: medium
Maintainer: Sam Hartman <hartmans@debian.org>
Changed-By: Sam Hartman <hartmans@debian.org>
Description:
 krb5-admin-server - MIT Kerberos master server (kadmind)
 krb5-doc   - documentation for MIT Kerberos
 krb5-gss-samples - MIT Kerberos GSS Sample applications
 krb5-k5tls - TLS plugin for MIT Kerberos
 krb5-kdc   - MIT Kerberos key server (KDC)
 krb5-kdc-ldap - MIT Kerberos key server (KDC) LDAP plugin
 krb5-kpropd - MIT Kerberos key server (KDC)
 krb5-locales - internationalization support for MIT Kerberos
 krb5-multidev - development files for MIT Kerberos without Heimdal conflict
 krb5-otp   - OTP plugin for MIT Kerberos
 krb5-pkinit - PKINIT plugin for MIT Kerberos
 krb5-user  - basic programs to authenticate using MIT Kerberos
 libgssapi-krb5-2 - MIT Kerberos runtime libraries - krb5 GSS-API Mechanism
 libgssrpc4 - MIT Kerberos runtime libraries - GSS enabled ONCRPC
 libk5crypto3 - MIT Kerberos runtime libraries - Crypto Library
 libkadm5clnt-mit11 - MIT Kerberos runtime libraries - Administration Clients
 libkadm5srv-mit11 - MIT Kerberos runtime libraries - KDC and Admin Server
 libkdb5-8  - MIT Kerberos runtime libraries - Kerberos database
 libkrad-dev - MIT Kerberos RADIUS Library Development
 libkrad0   - MIT Kerberos runtime libraries - RADIUS library
 libkrb5-3  - MIT Kerberos runtime libraries
 libkrb5-dbg - debugging files for MIT Kerberos
 libkrb5-dev - headers and development libraries for MIT Kerberos
 libkrb5support0 - MIT Kerberos runtime libraries - Support library
Closes: 856307 860767
Changes:
 krb5 (1.15-2) experimental; urgency=medium
 .
   * Upstream patches to fix startup if getaddrinfo() returns a wildcard v6
     address, and to fix handling of explicitly specified v4 wildcard
     address; regression over previous versions, Closes: #860767
   * Fix SRV lookups to respect udp_preference_limit, regression over
     previous versions with OTP, Closes: #856307
Checksums-Sha1:
 b501b4796a85da416072f52a38fcee91058e7e89 3229 krb5_1.15-2.dsc
 464d61ed5691246c469398421a216b0c3520c76a 143788 krb5_1.15-2.debian.tar.xz
 b3c11d14cbeea57a9b4416edfdaa824ceb56f166 184908 krb5-admin-server-dbgsym_1.15-2_amd64.deb
 b75186b66577939a862160bafe6dd9e88664fa35 118540 krb5-admin-server_1.15-2_amd64.deb
 0d4057758632203f9963b31c801967796cc27af8 2250752 krb5-doc_1.15-2_all.deb
 cfb8bf20258cf03b2197451b7e5bc0bef6a6a7b6 39786 krb5-gss-samples-dbgsym_1.15-2_amd64.deb
 a9cab87222e12a57c8706212cee2c2e3f5aae86a 59662 krb5-gss-samples_1.15-2_amd64.deb
 c591330115cf691a5020b799cbf6a7b5b54803b4 20980 krb5-k5tls-dbgsym_1.15-2_amd64.deb
 dc65ece45650f4fde260422a9739c4a84b42eb65 49782 krb5-k5tls_1.15-2_amd64.deb
 e31a462624c4e0e9002c77f7a0dc26632a0209f8 513456 krb5-kdc-dbgsym_1.15-2_amd64.deb
 6fd00320f9173c560ddb993c14c039748b39ca83 255078 krb5-kdc-ldap-dbgsym_1.15-2_amd64.deb
 8f0b6e728a73425652b9c187c60532743b26039a 117830 krb5-kdc-ldap_1.15-2_amd64.deb
 da9a7742da450b300b678e0c867584883f64f648 221440 krb5-kdc_1.15-2_amd64.deb
 d5c3f91959f30d248f69c8aafc4beb5ded046644 46450 krb5-kpropd_1.15-2_amd64.deb
 55c80b654e4ab34c9ef7db0a833849c96cd6f055 93840 krb5-locales_1.15-2_all.deb
 b511d32786fa76332bf1153ef76fe76b1178c5a6 150510 krb5-multidev_1.15-2_amd64.deb
 aa32b2863f4e80803d065f4aeaed09deaecdba91 27322 krb5-otp-dbgsym_1.15-2_amd64.deb
 6dcb00c262e84e2b495fcd608121bbcbfebed74e 50870 krb5-otp_1.15-2_amd64.deb
 1e8414f629ba66b44136d230a3afcd64e585d903 152138 krb5-pkinit-dbgsym_1.15-2_amd64.deb
 5d63284956f8811b29dbc5b93f171deef754893d 86912 krb5-pkinit_1.15-2_amd64.deb
 2aefe7338800af729e95a054308c388c530c3fa6 195366 krb5-user-dbgsym_1.15-2_amd64.deb
 7ad2dcb908c638915e2a664159e6abb143346723 146242 krb5-user_1.15-2_amd64.deb
 4acfb54b9d3b47fac71f9b1a27e536f9ca31a4ca 17265 krb5_1.15-2_amd64.buildinfo
 4bcd7b6085764737babbc85640ccd99ea4f17a13 154856 libgssapi-krb5-2_1.15-2_amd64.deb
 be9170fe52522d115f0665e35680c16f66eceba5 89152 libgssrpc4_1.15-2_amd64.deb
 618c8f7af5d5e4459cbd55c7bd381398b4b3e275 119266 libk5crypto3_1.15-2_amd64.deb
 ad5a4e85e0774c0dd3e63d682bce3b8cf0884295 71990 libkadm5clnt-mit11_1.15-2_amd64.deb
 7add76b81a5d4ae59170bca39d64f4fba21b4be5 86276 libkadm5srv-mit11_1.15-2_amd64.deb
 88d5d5052fd54f8193cab13712fbf15d634926fc 71122 libkdb5-8_1.15-2_amd64.deb
 401d6ebcc8e31ac198ad0f2f2df8e36f53ade117 46138 libkrad-dev_1.15-2_amd64.deb
 7f9ccaccdb78539544443aa2bef86b2cdf68532e 55558 libkrad0_1.15-2_amd64.deb
 c5714fea95d24cc797849e9971d3cdf621cbe68c 311536 libkrb5-3_1.15-2_amd64.deb
 b21a86f63c3ef788e36e77f853203407c774c3ba 2515822 libkrb5-dbg_1.15-2_amd64.deb
 3fa3590567d7e2b937fbf8196a613da1dcd6fdea 45624 libkrb5-dev_1.15-2_amd64.deb
 c041d9750b6c463f5f20dbca3985bc9b49344032 61946 libkrb5support0_1.15-2_amd64.deb
Checksums-Sha256:
 7df635e46b19e62ae7523f9fb0319eaecf658b26a990444a49a26e94f3bfdab9 3229 krb5_1.15-2.dsc
 9cea98e733ec66dc628eb60f9990e7898355032fa2b7d31895905907c54f9dce 143788 krb5_1.15-2.debian.tar.xz
 ba104eb6def2a25ad3f56ead484e7cef87da70c1da9546eba35e120fa1d31d86 184908 krb5-admin-server-dbgsym_1.15-2_amd64.deb
 f1b483e66f1849536adb6c87dc6ce3731233fa7136806c057d737a7007d36702 118540 krb5-admin-server_1.15-2_amd64.deb
 212b8ddd1c04174f4542aecfacb00cd74dd390ae15d04063001fb2dead801f36 2250752 krb5-doc_1.15-2_all.deb
 91e770c58a7e77a26505958f791f083546e7336131fff07ddee70cc92328e670 39786 krb5-gss-samples-dbgsym_1.15-2_amd64.deb
 b932fdd63c04d717a7c68d8c0674a7560dd4d76ec5a08066310ef1c7cdca3aab 59662 krb5-gss-samples_1.15-2_amd64.deb
 3a164de2ed9aa91d699426682f2df81f77609f8fba78ec930c08ea016a1a7dba 20980 krb5-k5tls-dbgsym_1.15-2_amd64.deb
 48a14c0db9330d10067563e12ab838bf69be9927d0cb9cb639c5500803dd3f6a 49782 krb5-k5tls_1.15-2_amd64.deb
 136b6f0499b0f3adc55aaebaca4a4038d031002fa5334f1c4686fa9e7cebcad9 513456 krb5-kdc-dbgsym_1.15-2_amd64.deb
 9b3284ebf688a6833e8af5afcf8e8b25348dd8e085676d3801b69320f9054d4f 255078 krb5-kdc-ldap-dbgsym_1.15-2_amd64.deb
 3b49c10e321a7965248f112ba6d08f1014b2b13bf5e2f14690271d6dbcac308e 117830 krb5-kdc-ldap_1.15-2_amd64.deb
 da88fde8fc2a2a0da8153b056ce913b6aba494296cb3c3c7b412a9a5b95bd629 221440 krb5-kdc_1.15-2_amd64.deb
 143d4bffb4d5068fe02ef8e21b4684cfe2afd060350e56b0e58a4bf998ba49e6 46450 krb5-kpropd_1.15-2_amd64.deb
 8b11eec60fb2bef0cc2d5f30f462346ed3047facae27cff09f2e523b2f20a35d 93840 krb5-locales_1.15-2_all.deb
 c6871a09476b295da409f9fc49628410920190237691e4af1023b6194b547a95 150510 krb5-multidev_1.15-2_amd64.deb
 5560d8b3afb335c997421717547941139a6ed18ab7c92eceb178069d840b4e76 27322 krb5-otp-dbgsym_1.15-2_amd64.deb
 ce79be605b627d84e314778535b0c0e037ce2027fa3ed88cf4889b441f599030 50870 krb5-otp_1.15-2_amd64.deb
 d8856c943ebdcdb49241405daa4293451459ea242cb3d5249f0c1a9486e15783 152138 krb5-pkinit-dbgsym_1.15-2_amd64.deb
 d0a41dec4d6bc17d8c8c7804985f1ee23f485e0180e8702ec0b4502c96ba6cf5 86912 krb5-pkinit_1.15-2_amd64.deb
 7c47db9170767130b2d6302ad3a4cb5649748062786facf1974c99ce85d4235d 195366 krb5-user-dbgsym_1.15-2_amd64.deb
 f58bdfb7bc2343643d3202bae4000b2ae5e359a2d3e096c986aafd5be7d1f075 146242 krb5-user_1.15-2_amd64.deb
 ec66b299efd7a6ff02577f44f96c3bc4a7243f0bb92923b348e1c6fbb05e749b 17265 krb5_1.15-2_amd64.buildinfo
 facdbbfdcaad746c64d3cdcf10240e47dc7284e913eb8141c47c4cc46b514610 154856 libgssapi-krb5-2_1.15-2_amd64.deb
 b8eb63ca3404b10995c54b20b418954870ecacef7bbe6a9804cb6c7750ec30bf 89152 libgssrpc4_1.15-2_amd64.deb
 5aad43581df6f54e915b8470242f06e260eaf6dba18d378f667af4f294f14c52 119266 libk5crypto3_1.15-2_amd64.deb
 e56dd769373e7f11685eb2bea9b6bfc3ed73c960fe76bf4013628589c5c89d86 71990 libkadm5clnt-mit11_1.15-2_amd64.deb
 cc1d2a0d8fcf29f7e0f4de88d356e09d2cf8cae232e4d08c510fb2df7d818182 86276 libkadm5srv-mit11_1.15-2_amd64.deb
 174a1df27457cbebd6bf94b15e425e0b1d6840f2225196754874d20d520be38f 71122 libkdb5-8_1.15-2_amd64.deb
 c230d783fce119bcf41c6c8257536b1ab93b296b19f60153c943163f16623e50 46138 libkrad-dev_1.15-2_amd64.deb
 28237afff5ba7a7fa10324fff1cac81359e7470002f13eafb0ead75885707f20 55558 libkrad0_1.15-2_amd64.deb
 01b9fbe37657a728d70d104347d751cfdc7d10700bfb9a25edd2682574430136 311536 libkrb5-3_1.15-2_amd64.deb
 ef716a1a581e59b762e28d94f09bce052f768640ffe22ad356d76a05c3a5ef88 2515822 libkrb5-dbg_1.15-2_amd64.deb
 dd2b8da18a385f8e528c15003a316f14faa4b3ef619777a9bc395a5d7f64e2f4 45624 libkrb5-dev_1.15-2_amd64.deb
 91661430b2bfb3ab3bae2513c6fb1ab7600db1958b2a7e37d0353c2bfd5286bf 61946 libkrb5support0_1.15-2_amd64.deb
Files:
 6593a318f5bd23821f1249254da47a5a 3229 net standard krb5_1.15-2.dsc
 4e3f5e9456173d1eee9a118f6cbba0a2 143788 net standard krb5_1.15-2.debian.tar.xz
 ea005cc1ccf046c62cbb79fe11c55a9e 184908 debug extra krb5-admin-server-dbgsym_1.15-2_amd64.deb
 e8af174c10117501d3792c45fc711bf1 118540 net optional krb5-admin-server_1.15-2_amd64.deb
 6ead7a02bf499a120859f46f5ed7fe62 2250752 doc optional krb5-doc_1.15-2_all.deb
 6ef033499601b48609a9478951bc86ce 39786 debug extra krb5-gss-samples-dbgsym_1.15-2_amd64.deb
 d277455a5c643b3a9b5e53d569275525 59662 net extra krb5-gss-samples_1.15-2_amd64.deb
 0d77370dda52ebf105e353ab156f0659 20980 debug extra krb5-k5tls-dbgsym_1.15-2_amd64.deb
 8f95606ea9938fff8eb31e179486b135 49782 net extra krb5-k5tls_1.15-2_amd64.deb
 704d4414a0b642d0d1eced65ea5f4fc3 513456 debug extra krb5-kdc-dbgsym_1.15-2_amd64.deb
 88dbf54626608062de5d46ff16687c56 255078 debug extra krb5-kdc-ldap-dbgsym_1.15-2_amd64.deb
 888bd16bc029e5bfda400493e93b8cb2 117830 net extra krb5-kdc-ldap_1.15-2_amd64.deb
 311ae5d152ab467e7308a9652b8a7876 221440 net optional krb5-kdc_1.15-2_amd64.deb
 58416d89023ffe7089baf7f183131eaf 46450 net optional krb5-kpropd_1.15-2_amd64.deb
 6621c83904effb29c57157c7e39ab99f 93840 localization standard krb5-locales_1.15-2_all.deb
 dbafe3b3ba54bdf25dd195e121a2ef48 150510 libdevel optional krb5-multidev_1.15-2_amd64.deb
 7dff08b175a8b67b6bdd05f9231a3dc6 27322 debug extra krb5-otp-dbgsym_1.15-2_amd64.deb
 6e8d9f65b68cb889137aca8d11b14ea3 50870 net extra krb5-otp_1.15-2_amd64.deb
 f2738893d0d84cd2a4b76072b31feaf4 152138 debug extra krb5-pkinit-dbgsym_1.15-2_amd64.deb
 dec7501a4f1b5c02b027a99960c76bf8 86912 net extra krb5-pkinit_1.15-2_amd64.deb
 b38ef5250a3ce2198d1045951d5a8367 195366 debug extra krb5-user-dbgsym_1.15-2_amd64.deb
 45ed628b05765db6531a8fae04b60175 146242 net optional krb5-user_1.15-2_amd64.deb
 092e2fb18d054929576b594f169f0011 17265 net standard krb5_1.15-2_amd64.buildinfo
 0b5fbcde99f22434bbe93b3d575d4265 154856 libs standard libgssapi-krb5-2_1.15-2_amd64.deb
 9847fe02e809379a6e40a6fc4d9bfa29 89152 libs standard libgssrpc4_1.15-2_amd64.deb
 907c7fe440fc035e53c433f26bbb3999 119266 libs standard libk5crypto3_1.15-2_amd64.deb
 b73a4722f866b5aa69e7cead373a9fc7 71990 libs standard libkadm5clnt-mit11_1.15-2_amd64.deb
 fda39825313447cb4de146d14b15ed78 86276 libs standard libkadm5srv-mit11_1.15-2_amd64.deb
 7f4d7d1b8a32058167c4e8745a32dacf 71122 libs standard libkdb5-8_1.15-2_amd64.deb
 ffeff7971d075fae797edbc4a34dd3a7 46138 libdevel extra libkrad-dev_1.15-2_amd64.deb
 1fd3317291918b07c7ee6fbec42c807b 55558 libs standard libkrad0_1.15-2_amd64.deb
 c2d949d59da25a2b8a897f947b99feb5 311536 libs standard libkrb5-3_1.15-2_amd64.deb
 014c685c8f4c2e4db322f656237daad2 2515822 debug extra libkrb5-dbg_1.15-2_amd64.deb
 94d213a1fe7c0f7998a99873fb719088 45624 libdevel extra libkrb5-dev_1.15-2_amd64.deb
 9e861a655d780923f9356511d67118bd 61946 libs standard libkrb5support0_1.15-2_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQGfBAEBCAAdFiEEz1cSziAwmFRQyTi4fJpR9iayVp8FAlj5ZAsACgkQfJpR9iay
Vp+c0gtgmg9gbLAA7aamKgY6shcdciT6nXC+Uc94EBHkJMd/bYECaA4jVGAhEfsX
zChvypfXsr0bFLfdWzb9wA9BtK1ohA+rY16fzCAtDGnRGIKGqKErzwaNZTxUSOhw
dLWQbjUfS984+0H4faKPW/VxW/QVqD7zGOS+AMfWSkBgapcbPzqUmnjRtL63i7yn
m+6rTJfrl0mci/s4EF984B7TCffCi+sP2+mdarAknGlmlxjLPV4eK3KRuINt1pXC
IZfq+MID/QvHtfRj861ugmU1+vDo2ZBLpAbtcgP8+xXWSfW6UvkyZqsRd1BRJjnz
hwIhtFAAs0aRgHzcIeRBSx/gERrbZNwDx/99zH1NNtDB5kLGYFiIsOiRBtUStllq
gF+T0rQpWunCUibIIHYw74xe3/krLvmDFXmWLBLcCgWl6XJwqm5z7Y27DjsXsIZi
wVX5/mjSoKyyCvMUw9pnsOXzy37L5IL9JmeJsfy0/uCY4A==
=ffU+
-----END PGP SIGNATURE-----

Message #86 received at 856307-close@bugs.debian.org (full text, mbox, reply):

From: Sam Hartman <hartmans@debian.org>

To: 856307-close@bugs.debian.org

Subject: Bug#856307: fixed in krb5 1.15-1+deb9u1

Date: Sat, 12 Aug 2017 16:17:09 +0000

Source: krb5
Source-Version: 1.15-1+deb9u1

We believe that the bug you reported is fixed in the latest version of
krb5, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 856307@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sam Hartman <hartmans@debian.org> (supplier of updated krb5 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Wed, 09 Aug 2017 12:19:50 -0400
Source: krb5
Binary: krb5-user krb5-kdc krb5-kdc-ldap krb5-admin-server krb5-kpropd krb5-multidev libkrb5-dev libkrb5-dbg krb5-pkinit krb5-otp krb5-k5tls krb5-doc libkrb5-3 libgssapi-krb5-2 libgssrpc4 libkadm5srv-mit11 libkadm5clnt-mit11 libk5crypto3 libkdb5-8 libkrb5support0 libkrad0 krb5-gss-samples krb5-locales libkrad-dev
Architecture: source
Version: 1.15-1+deb9u1
Distribution: stretch
Urgency: high
Maintainer: Sam Hartman <hartmans@debian.org>
Changed-By: Sam Hartman <hartmans@debian.org>
Description:
 krb5-admin-server - MIT Kerberos master server (kadmind)
 krb5-doc   - documentation for MIT Kerberos
 krb5-gss-samples - MIT Kerberos GSS Sample applications
 krb5-k5tls - TLS plugin for MIT Kerberos
 krb5-kdc   - MIT Kerberos key server (KDC)
 krb5-kdc-ldap - MIT Kerberos key server (KDC) LDAP plugin
 krb5-kpropd - MIT Kerberos key server (KDC)
 krb5-locales - internationalization support for MIT Kerberos
 krb5-multidev - development files for MIT Kerberos without Heimdal conflict
 krb5-otp   - OTP plugin for MIT Kerberos
 krb5-pkinit - PKINIT plugin for MIT Kerberos
 krb5-user  - basic programs to authenticate using MIT Kerberos
 libgssapi-krb5-2 - MIT Kerberos runtime libraries - krb5 GSS-API Mechanism
 libgssrpc4 - MIT Kerberos runtime libraries - GSS enabled ONCRPC
 libk5crypto3 - MIT Kerberos runtime libraries - Crypto Library
 libkadm5clnt-mit11 - MIT Kerberos runtime libraries - Administration Clients
 libkadm5srv-mit11 - MIT Kerberos runtime libraries - KDC and Admin Server
 libkdb5-8  - MIT Kerberos runtime libraries - Kerberos database
 libkrad-dev - MIT Kerberos RADIUS Library Development
 libkrad0   - MIT Kerberos runtime libraries - RADIUS library
 libkrb5-3  - MIT Kerberos runtime libraries
 libkrb5-dbg - debugging files for MIT Kerberos
 libkrb5-dev - headers and development libraries for MIT Kerberos
 libkrb5support0 - MIT Kerberos runtime libraries - Support library
Closes: 856307 860767 869260
Changes:
 krb5 (1.15-1+deb9u1) stretch; urgency=high
 .
   * CVE-2017-11368: Remote authenticated attackers can crash the KDC,
     Closes: #869260
   * Upstream patches to fix startup if getaddrinfo() returns a wildcard v6
     address, and to fix handling of explicitly specified v4 wildcard
     address; regression over previous versions, Closes: #860767
   * Fix SRV lookups to respect udp_preference_limit, regression over
     previous versions with OTP, Closes: #856307
Checksums-Sha1:
 3865bd0c4b019aef44e8fbb08cd0a875f4ab2e50 3373 krb5_1.15-1+deb9u1.dsc
 35368ab78bb847d0b23cc957bfb931e6fb45dd61 144944 krb5_1.15-1+deb9u1.debian.tar.xz
Checksums-Sha256:
 cb69444c826f380c9d3ea7c5e6bf04105ca2fceb26ecc14b293f458f337f34c2 3373 krb5_1.15-1+deb9u1.dsc
 f04183b2ecfd0fe488975338eb4f900d5f605c81a9ae279451ceda948d99a21c 144944 krb5_1.15-1+deb9u1.debian.tar.xz
Files:
 03dd0ab3bfb4c70bd8bea0437db65194 3373 net standard krb5_1.15-1+deb9u1.dsc
 981da9e09bcd891263f0a05d4789e7fe 144944 net standard krb5_1.15-1+deb9u1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQGfBAEBCAAdFiEEz1cSziAwmFRQyTi4fJpR9iayVp8FAlmOZ/IACgkQfJpR9iay
Vp+xggtdHdvSRs7m6ZmvcvY2exjBKZjNuu4fE1yOoG0NxrtolEJ1Wmr10jKbDOV/
GAmjCKYCn/OLH7owt4Lk+G8TBMdfqXx4Vszbp4p3/mrlHaUyqgkL/bLLjfgjg49t
i+RnEIOQR9oLBNTeHyebPSXIbcj57waI4/GlbNu9uLVJ/widI5+wfIWQfecJvmLP
33FmwBJtniHn4+Zh7bnusyZ3XtRDOcBlQA4ywmYv5XX0ldEWLg4NjBJNAHLNeBvD
x2Dq/EbDoO7sAH+/GAW3nsT1/ck/Q8pmKyn1qF19S2HFVHDOAZEUJeAMs9yqGHGT
+Bd6J8021HDc+jRJ6bolbb3mFL7qhGc9dZCSjIruM3IjFP99/W6/z4/YjJRmlG5F
3eei0CLPjPvuVTXq0uQ5XGw7FDUejklbP6ZogC9b+ESYjPlUoLsyaXG+rwuqqfFD
i8QoVmpPopwuDpPILvtfericz9rOr9cN4UfUtatCmf85FQ==
=rgzE
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.