Man 5 page for kdc.conf does not mention acceptable encryption types

Bug #900447 reported by Leonardo Borda
14
This bug affects 2 people
Affects Status Importance Assigned to Milestone
krb5 (Ubuntu)
Low
Unassigned

Bug Description

Hi

It would be helpful if the man 5 page for kdc.conf could explicitly specify the acceptable encryption types we can use.

Currently the only way is looking at the source code in the following file:
/krb5-1.9.1+dfsg/src/lib/crypto/krb/etypes.c

grep ENCTYPE_ ./krb5-1.9.1+dfsg/src/lib/crypto/krb/etypes.c
    { ENCTYPE_DES_CBC_CRC,
    { ENCTYPE_DES_CBC_MD4,
    { ENCTYPE_DES_CBC_MD5,
    { ENCTYPE_DES_CBC_RAW,
    { ENCTYPE_DES3_CBC_RAW,
    { ENCTYPE_DES3_CBC_SHA1,
    { ENCTYPE_DES_HMAC_SHA1,
    { ENCTYPE_ARCFOUR_HMAC,
    { ENCTYPE_ARCFOUR_HMAC_EXP,
    { ENCTYPE_AES128_CTS_HMAC_SHA1_96,
    { ENCTYPE_AES256_CTS_HMAC_SHA1_96,
    { ENCTYPE_CAMELLIA128_CTS_CMAC,
    { ENCTYPE_CAMELLIA256_CTS_CMAC,

Leonardo

ProblemType: Bug
DistroRelease: Ubuntu 11.10
Package: krb5-kdc 1.9.1+dfsg-1ubuntu2.1
Uname: Linux 3.2.0-999-generic x86_64
ApportVersion: 1.23-0ubuntu4
Architecture: amd64
Date: Mon Dec 5 14:31:49 2011
ProcEnviron:
 LANGUAGE=en_US:
 LANG=en_US
 SHELL=/bin/bash
SourcePackage: krb5
UpgradeStatus: No upgrade log present (probably fresh install)

Revision history for this message
Leonardo Borda (lborda) wrote :
summary: - Man 5 page for kdc.conf does not mention acceptable values
+ Man 5 page for kdc.conf does not mention acceptable encryption types
Revision history for this message
Russ Allbery (rra-debian) wrote : Re: [Bug 900447] [NEW] Man 5 page for kdc.conf does not mention acceptable encryption types

Leonardo Borda <email address hidden> writes:

> It would be helpful if the man 5 page for kdc.conf could explicitly
> specify the acceptable encryption types we can use.

> Currently the only way is looking at the source code in the following
> file: /krb5-1.9.1+dfsg/src/lib/crypto/krb/etypes.c

They're listed in the krb5-admin info pages included in krb5-doc under
Configuration Files.

--
Russ Allbery (<email address hidden>) <http://www.eyrie.org/~eagle/>

Revision history for this message
Sam Hartman (hartmans) wrote : Re: [Bug 900447] [NEW] Man 5 page for kdc.conf does not mention acceptable encryption types

Russ, I thought that they were listed in the admin info pages too.
however, while I see a bunch of examples, searching for the string hmac
in the sources to the admin guide, I don't actually find a complete list
of the encryption types anywhere.
Am I missing something?

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in krb5 (Ubuntu):
status: New → Confirmed
Revision history for this message
Taylor Yu (tlyu) wrote : Re: [Bug 900447] [NEW] Man 5 page for kdc.conf does not mention acceptable encryption types

Sam Hartman <email address hidden> writes:

> Russ, I thought that they were listed in the admin info pages too.
> however, while I see a bunch of examples, searching for the string hmac
> in the sources to the admin guide, I don't actually find a complete list
> of the encryption types anywhere.
> Am I missing something?

They could be in definitions.texinfo or or support-enc.texinfo.

Revision history for this message
Sam Hartman (hartmans) wrote : Re: [Bug 900447] [NEW] Man 5 page for kdc.conf does not mention acceptable encryption types

They are in fact in support-enc.texinfo.
OK.
So, to the extent there is a bug it's that kdc.conf's manpage doesn't
tell you to go look at the admin guide.
I don't think we want to duplicate the information.

Revision history for this message
J Sadler (jsadler) wrote :

You may want to reconsider adding it to kdc.conf's man page.

I don't believe that in a normal client install that you would get the admin guide. Don't you only get it if you install the admin packages? If you are in a mixed environment as a client and the kerb server is something other than Ubuntu/Debian is it reasonable to expect the user to load a package that they aren't going to use so they can get the info needed to configure their client?

Revision history for this message
Russ Allbery (rra-debian) wrote : Re: [Bug 900447] Re: Man 5 page for kdc.conf does not mention acceptable encryption types

J Sadler <email address hidden> writes:

> You may want to reconsider adding it to kdc.conf's man page.

> I don't believe that in a normal client install that you would get the
> admin guide. Don't you only get it if you install the admin packages?

It's part of the krb5-doc package, which you will often want to install on
a client installation if you're not already deeply familiar with Kerberos.
There are lots of other things related to client configuration that are
better-documented in the texinfo manual than in the man pages. (Man pages
aren't the greatest format for a full-blown reference manual; they don't
have very much useful structure.)

--
Russ Allbery (<email address hidden>) <http://www.eyrie.org/~eagle/>

Revision history for this message
Sam Hartman (hartmans) wrote : Re: [Bug 900447] Re: Man 5 page for kdc.conf does not mention acceptable encryption types

>>>>> "J" == J Sadler <email address hidden> writes:

    J> You may want to reconsider adding it to kdc.conf's man page. I
    J> don't believe that in a normal client install that you would get
    J> the admin guide. Don't you only get it if you install the admin
    J> packages?

1) It's in krb5-doc; anyone can install that

2) Really end-users have very little business setting those config
values. With the exception of some unfortunate bugs with NFS, it more
or less means that the Kerberos admin has screwed up if you find
yourself needing to care about enctypes. Which of course does happen,
so if it were in krb5-admin-server not krb5-doc I'd agree with your
point. However, asking people to look on the web or at detailed
documentation for a complex issue seems reasonable to me.

--Sam

Changed in krb5 (Ubuntu):
importance: Undecided → Low
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers