Page MenuHomeFreeBSD
Differential D53884

pam_krb5: Restore allow_kdc_spoof option
ClosedPublic
Actions

Authored by des on Nov 22 2025, 4:57 PM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Sep 8, 2:54 PM
Unknown Object (File)
Sat, Sep 5, 7:53 PM
Unknown Object (File)
Thu, Aug 27, 2:53 AM
Unknown Object (File)
Thu, Aug 13, 12:03 AM
Unknown Object (File)
Aug 10 2026, 11:31 AM
Unknown Object (File)
Aug 8 2026, 5:53 AM
Unknown Object (File)
Aug 5 2026, 9:26 AM
Unknown Object (File)
Jul 28 2026, 9:37 PM
View All 71 Files
Subscribers
cperciva
imp

Details

Reviewers
cy
ivy
Group Reviewers
security
Commits
rG8fdafb396677: pam_krb5: Restore allow_kdc_spoof option
rG2eb030d1c8f1: pam_krb5: Restore allow_kdc_spoof option
rGfe5c8baf25a5: pam_krb5: Restore allow_kdc_spoof option
Summary

Not only does the new pam_krb5 module not have the same allow_kdc_spoof
option that the old one had, its behavior in this matter defaults to
insecure. Reimplement allow_kdc_spoof and switch the default back.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 68808
Build 65691: arc lint + arc unit

Event Timeline

des created this revision.Nov 22 2025, 4:57 PM
Herald added a subscriber: imp. · View Herald TranscriptNov 22 2025, 4:57 PM
des requested review of this revision.Nov 22 2025, 4:57 PM
des added a child revision: D53885: pam_krb5: Fix manual page in MIT case.
des added a comment.Nov 22 2025, 4:58 PM

Note that this patch updates the source for the documentation but not the mdoc file that we actually install; see D53885 for that.

Harbormaster completed remote builds in B68808: Diff 166968.Nov 22 2025, 4:58 PM
cy accepted this revision as: cy.Nov 23 2025, 3:11 PM
This revision is now accepted and ready to land.Nov 23 2025, 3:11 PM
cperciva added a subscriber: cperciva.Nov 23 2025, 11:28 PM

@des Please commit this and MFC to stable/15 ASAP so I can get it into 15.0-RC4 builds on Monday.

des added a comment.Nov 24 2025, 1:01 AM

I am not committing this without the documentation, which has still not been approved.

Closed by commit rGfe5c8baf25a5: pam_krb5: Restore allow_kdc_spoof option (authored by des). · Explain WhyNov 24 2025, 2:41 AM
This revision was automatically updated to reflect the committed changes.
des added a commit: rGfe5c8baf25a5: pam_krb5: Restore allow_kdc_spoof option.
des added a commit: rG2eb030d1c8f1: pam_krb5: Restore allow_kdc_spoof option.Nov 24 2025, 3:15 AM
cperciva added a commit: rG8fdafb396677: pam_krb5: Restore allow_kdc_spoof option.Nov 24 2025, 6:23 AM

Revision Contents
Changeset List

PathSize
contrib/
pam-krb5/
docs/
15 lines
module/
6 lines
3 lines
3 lines

Diff 166968

View Options

contrib/pam-krb5/docs/pam_krb5.pod

Loading...
View Options

contrib/pam-krb5/module/auth.c

Loading...
View Options

contrib/pam-krb5/module/internal.h

Loading...
View Options

contrib/pam-krb5/module/options.c

Loading...