Bug 239223 - krb5 should not use host/* principals
Summary: krb5 should not use host/* principals
Keywords:
Status: CLOSED UPSTREAM
Alias: None
Product: Fedora
Classification: Fedora
Component: koji
Version: 6
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: David Cantrell
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-05-06 12:41 UTC by Enrico Scholz
Modified: 2013-01-10 01:37 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2007-11-15 16:46:17 UTC
Type: ---
Embargoed:

Attachments (Terms of Use)

Description Enrico Scholz 2007-05-06 12:41:00 UTC 
Description of problem:

There is an hardcoded server principal of 'host/%s' in
ClientSession::_serverPrincipal() in
/usr/lib/python2.4/site-packages/koji/__init__.py


This is bad because 'host/*' principals are for system services only and the
keytab can/must not be read by non-root users. As koji services (hub) are run by
the 'httpd' user, this will not work.

There should be used (customizable) principal names like HTTP/* instead of.



Version-Release number of selected component (if applicable):

koji-1.1-1
Comment 1 Jesse Keating 2007-06-12 19:54:34 UTC 
Filed upstream as https://hosted.fedoraproject.org/projects/koji/ticket/32 
Waiting for an upstream fix to release.
Comment 2 Jesse Keating 2007-11-15 16:46:17 UTC 
Closing this as upstream here to.  Really needs to be fixed upstream and it will
filter down to the Fedora release.
Note You need to log in before you can comment on or make changes to this bug.