Re: [patch] krb5 authentication on multihomed server hosts

I think this is fixed in CVS and will be in 8.1. We now have in
postgresql.conf:

# Kerberos
#krb_server_keyfile = ''
#krb_srvname = 'postgres'
#krb_server_hostname = '(any)' # if not set, matches any keytab entry
#krb_caseins_users = off

---------------------------------------------------------------------------

Martin Pitt wrote:
-- Start of PGP signed section.
> Hi!
>
> I recently got a Debian bug report [1] that says:
>
> "It is not always possible to use krb5 authentication to a server
> that is listening on multiple interfaces other than to the 'primary'
> interface.
>
> More specifically: src/backend/libpq/auth.c pg_krb5_init() fills in
> the pg_krb5_server principal with a call to krb5_sname_to_principal
> with NULL as the second argument (the hostname argument). This
> invokes the hostname canonicalisation behaviour in the kerberos
> library which has insufficient information to be able to return the
> correct answer in all cases."
>
> The bug report describes this a little deeper with a detailled
> example. The reporter also proposes a patch, which I copied below for
> your convenience. It looks pretty sane and is relatively unintrusive.
> However, since I don't know much about Kerberos, I'd like to hear
> another opinion.
>
> Since this is by no way Debian specific, would you be interested to
> fix this upstream as well?
>
> Thanks for considering and have a nice day!
>
> Martin
>
> --------------- snip -------------------
> --- postgresql-7.4.7-old/src/backend/libpq/auth.c 2003-12-20 18:25:02.000000000 +0000
> +++ postgresql-7.4.7/src/backend/libpq/auth.c 2005-07-25 19:55:26.000000000 +0100
> @@ -216,8 +216,18 @@
> return STATUS_ERROR;
> }
>
> - retval = krb5_sname_to_principal(pg_krb5_context, NULL, PG_KRB_SRVNAM,
> + if( VirtualHost && VirtualHost[0] )
> + {
> + char *host=VirtualHost;
> + while(*host==' ') host++; /* skip leading spaces (cf postmaster.c) */
> + retval = krb5_sname_to_principal(pg_krb5_context, host, PG_KRB_SRVNAM,
> + KRB5_NT_SRV_HST, &pg_krb5_server);
> + }
> + else
> + {
> + retval = krb5_sname_to_principal(pg_krb5_context, NULL, PG_KRB_SRVNAM,
> KRB5_NT_SRV_HST, &pg_krb5_server);
> + }
> if (retval)
> {
> ereport(LOG,
> --------------- snip -------------------
>
>
> [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=320049
>
> --
> Martin Pitt http://www.piware.de
> Ubuntu Developer http://www.ubuntu.com
> Debian Developer http://www.debian.org
>
> In a world without walls and fences, who needs Windows and Gates?
-- End of PGP section, PGP failed!

--
Bruce Momjian | http://candle.pha.pa.us
pgman(at)candle(dot)pha(dot)pa(dot)us | (610) 359-1001
+ If your life is a hard drive, | 13 Roberts Road
+ Christ can be your backup. | Newtown Square, Pennsylvania 19073