[Ach] Short kerberos section review

Denis Knauf denis.knauf+ach at gmail.com
Sun Feb 2 18:38:15 CET 2014


i read the pull-request:
First, i tried the configuration for mit-krb5 1.10.1 on debian/ubuntu,
it works fine for me.
With default it worked fine, too, but with des3, not aes, for example.

I can't say, what you need to know. It's like expected, an overview
about algorithm and possible problems with different implementations,
hints for existing installations and a working configuration. He has
experience or is an expert; knows the problems with DNSSEC and NTP.

Updating an existing a existing installation i did not test - i
installed a complete new server on a new machine. Because incompatible
algorithms-changes, it is possible, it could fail.

One thing, I miss: To advise, it's very important, that kerberos needs a
really secure machine as server. So, it's better to run only kerberos on
this server, nothing else.

The defaults of kerberos-servers are very stupid. it is really
important to change it manually. It's important to advice.
This pull-request is better than every default conf, so i say, pull it.


More information about the Ach mailing list