Set disallow-svr on all newly-created principals

Set the disallow-svr flag on all newly-created principals.  This
prohibits obtaining service tickets for the principal, which provides
some hardening against brute force attacks.  Since the create command
is designed for creation of user principals, not service principals,
and use of service tickets for user principals is quite obscure and
rare in Kerberos, this seems like a better default.

diff --git a/NEWS b/NEWS
index 5a72027c49b1c6e1e45f5c6fd7967610b9c04015..5bc10d2aede22101190627c9b6aebee52b5aa206 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,14 @@
                     User-Visible kadmin-remctl Changes
 
+kadmin-remctl 3.4 (unreleased)
+
+    Set the disallow-svr flag on all newly-created principals.  This
+    prohibits obtaining service tickets for the principal, which provides
+    some hardening against brute force attacks.  Since the create command
+    is designed for creation of user principals, not service principals,
+    and use of service tickets for user principals is quite obscure and
+    rare in Kerberos, this seems like a better default.
+
 kadmin-remctl 3.3 (2013-03-25)
 
     In the Heimdal version of kadmin-backend, retry the kadmin connection

diff --git a/kadmin-backend b/kadmin-backend
index 53c41c5fc39c30d499f9a07a46793170e5c88bdb..0d3c3c14d9bc59527658af7f0a0df50a96607f0a 100755 (executable)
--- a/kadmin-backend
+++ b/kadmin-backend
@@ -272,7 +272,7 @@ sub kadmin_create {
     check_password ($password);
     kadmin_config ($instance) or return;
     $principal = "$principal/$instance" if $instance;
-    my $command = 'add_principal +requires_preauth';
+    my $command = 'add_principal +requires_preauth -allow_svr';
     if ($CONFIG{$instance}{policy}) {
         $command .= " -policy $CONFIG{$instance}{policy}";
     } else {

diff --git a/kadmin-backend-heim b/kadmin-backend-heim
index a4a6b344939775b8a115e280b1ceb9e9f8c8e55a..237740e67d307d79eadfe8a300ffedeeb5d1cced 100755 (executable)
--- a/kadmin-backend-heim
+++ b/kadmin-backend-heim
@@ -284,7 +284,7 @@ sub kadmin_create {
     # We'd like to use the default attributes, but that unfortunately doesn't
     # seem to work to try loading them before the principal is actually
     # created.  Instead, load a default here.
-    my $attrs = KRB5_KDB_REQUIRES_PRE_AUTH;
+    my $attrs = KRB5_KDB_REQUIRES_PRE_AUTH | KRB5_KDB_DISALLOW_SVR;
     if ($status ne 'enabled') {
         $attrs |= KRB5_KDB_DISALLOW_ALL_TIX;
     }