|
Release Notes - Heimdal - Version Heimdal 1.5
New features - Support GSS name extensions/attributes - SHA512 support - No Kerberos 4 support - Basic support for MIT Admin protocol (SECGSS flavor) in kadmind (extract keytab) - Replace editline with libedit Release Notes - Heimdal - Version Heimdal 1.4 New features - Support for reading MIT database file directly - KCM is polished up and now used in production - NTLM first class citizen, credentials stored in KCM - Table driven ASN.1 compiler, smaller!, not enabled by default - Native Windows client support Notes - Disabled write support NDBM hdb backend (read still in there) since it can't handle large records, please migrate to a diffrent backend (like BDB4) Release Notes - Heimdal - Version Heimdal 1.3.3 Bug fixes - Check the GSS-API checksum exists before trying to use it [CVE-2010-1321] - Check NULL pointers before dereference them [kdc] Release Notes - Heimdal - Version Heimdal 1.3.2 Bug fixes - Don't mix length when clearing hmac (could memset too much) - More paranoid underrun checking when decrypting packets - Check the password change requests and refuse to answer empty packets - Build on OpenSolaris - Renumber AD-SIGNED-TICKET since it was stolen from US - Don't cache /dev/*random file descriptor, it doesn't get unloaded - Make C++ safe - Misc warnings Release Notes - Heimdal - Version Heimdal 1.3.1 Bug fixes - Store KDC offset in credentials - Many many more bug fixes Release Notes - Heimdal - Version Heimdal 1.3.1 New features - Make work with OpenLDAPs krb5 overlay Release Notes - Heimdal - Version Heimdal 1.3 New features - Partial support for MIT kadmind rpc protocol in kadmind - Better support for finding keytab entries when using SPN aliases in the KDC - Support BER in ASN.1 library (needed for CMS) - Support decryption in Keychain private keys - Support for new sqlite based credential cache - Try both KDC referals and the common DNS reverse lookup in GSS-API - Fix the KCM to not leak resources on failure - Add IPv6 support to iprop - Support localization of error strings in kinit/klist/kdestroy and Kerberos library - Remove Kerberos 4 support in application (still in KDC) - Deprecate DES - Support i18n password in windows domains (using UTF-8) - More complete API emulation of OpenSSL in hcrypto - Support for ECDSA and ECDH when linking with OpenSSL API changes - Support for settin friendly name on credential caches - Move to using doxygen to generate documentation. - Sprinkling __attribute__((depricated)) for old function to be removed - Support to export LAST-REQUST information in AS-REQ - Support for client deferrals in in AS-REQ - Add seek support for krb5_storage. - Support for split AS-REQ, first step for IA-KERB - Fix many memory leaks and bugs - Improved regression test - Support krb5_cccol - Switch to krb5_set_error_message - Support krb5_crypto_*_iov - Switch to use EVP for most function - Use SOCK_CLOEXEC and O_CLOEXEC (close on exec) - Add support for GSS_C_DELEG_POLICY_FLAG - Add krb5_cc_[gs]et_config to store data in the credential caches - PTY testing application Bugfixes - Make building on AIX6 possible. - Bugfixes in LDAP KDC code to make it more stable - Make ipropd-slave reconnect when master down gown Release Notes - Heimdal - Version Heimdal 1.2.1 * Bug [HEIMDAL-147] - Heimdal 1.2 not compiling on Solaris [HEIMDAL-151] - Make canned tests work again after cert expired [HEIMDAL-152] - iprop test: use full hostname to avoid realm resolving errors [HEIMDAL-153] - ftp: Use the correct length for unmap, msync Release Notes - Heimdal - Version Heimdal 1.2 * Bug [HEIMDAL-10] - Follow-up on bug report for SEGFAULT in gss_display_name/gss_export_name when using SPNEGO [HEIMDAL-15] - Re: [Heimdal-bugs] potential bug in Heimdal 1.1 [HEIMDAL-17] - Remove support for depricated [libdefaults]capath [HEIMDAL-52] - hdb overwrite aliases for db databases [HEIMDAL-54] - Two issues which affect credentials delegation [HEIMDAL-58] - sockbuf.c calls setsockopt with bad args [HEIMDAL-62] - Fix printing of sig_atomic_t [HEIMDAL-87] - heimdal 1.1 not building under cygwin in hcrypto [HEIMDAL-105] - rcp: sync rcp with upstream bsd rcp codebase [HEIMDAL-117] - Use libtool to detect symbol versioning (Debian Bug#453241) * Improvement [HEIMDAL-67] - Fix locking and store credential in atomic writes in the FILE credential cache [HEIMDAL-106] - make compile on cygwin again [HEIMDAL-107] - Replace old random key generation in des module and use it with RAND_ function instead [HEIMDAL-115] - Better documentation and compatibility in hcrypto in regards to OpenSSL * New Feature [HEIMDAL-3] - pkinit alg agility PRF test vectors [HEIMDAL-14] - Add libwind to Heimdal [HEIMDAL-16] - Use libwind in hx509 [HEIMDAL-55] - Add flag to krb5 to not add GSS-API INT|CONF to the negotiation [HEIMDAL-74] - Add support to report extended error message back in AS-REQ to support windows clients [HEIMDAL-116] - test pty based application (using rkpty) [HEIMDAL-120] - Use new OpenLDAP API (older deprecated) * Task [HEIMDAL-63] - Dont try key usage KRB5_KU_AP_REQ_AUTH for TGS-REQ. This drop compatibility with pre 0.3d KDCs. [HEIMDAL-64] - kcm: first implementation of kcm-move-cache [HEIMDAL-65] - Failed to compile with --disable-pk-init [HEIMDAL-80] - verify that [VU#162289]: gcc silently discards some wraparound checks doesn't apply to Heimdal Changes in release 1.1 * Read-only PKCS11 provider built-in to hx509. * Documentation for hx509, hcrypto and ntlm libraries improved. * Better compatibilty with Windows 2008 Server pre-releases and Vista. * Mac OS X 10.5 support for native credential cache. * Provide pkg-config file for Heimdal (heimdal-gssapi.pc). * Bug fixes. Changes in release 1.0.2 * Ubuntu packages. * Bug fixes. Changes in release 1.0.1 * Serveral bug fixes to iprop. * Make work on platforms without dlopen. * Add RFC3526 modp group14 as default. * Handle [kdc] database = { } entries without realm = stanzas. * Make krb5_get_renewed_creds work. * Make kaserver preauth work again. * Bug fixes. Changes in release 1.0 * Add gss_pseudo_random() for mechglue and krb5. * Make session key for the krbtgt be selected by the best encryption type of the client. * Better interoperability with other PK-INIT implementations. * Inital support for Mac OS X Keychain for hx509. * Alias support for inital ticket requests. * Add symbol versioning to selected libraries on platforms that uses GNU link editor: gssapi, hcrypto, heimntlm, hx509, krb5, and libkdc. * New version of imath included in hcrypto. * Fix memory leaks. * Bugs fixes. Changes in release 0.8.1 * Make ASN.1 library less paranoid to with regard to NUL in string to make it inter-operate with MIT Kerberos again. * Make GSS-API library work again when using gss_acquire_cred * Add symbol versioning to libgssapi when using GNU ld. * Fix memory leaks * Bugs fixes Changes in release 0.8 * PK-INIT support. * HDB extensions support, used by PK-INIT. * New ASN.1 compiler. * GSS-API mechglue from FreeBSD. * Updated SPNEGO to support RFC4178. * Support for Cryptosystem Negotiation Extension (RFC 4537). * A new X.509 library (hx509) and related crypto functions. * A new ntlm library (heimntlm) and related crypto functions. * Updated the built-in crypto library with bignum support using imath, support for RSA and DH and renamed it to libhcrypto. * Subsystem in the KDC, digest, that will perform the digest operation in the KDC, currently supports: CHAP, MS-CHAP-V2, SASL DIGEST-MD5 NTLMv1 and NTLMv2. * KDC will return the "response too big" error to force TCP retries for large (default 1400 bytes) UDP replies. This is common for PK-INIT requests. * Libkafs defaults to use 2b tokens. * Default to use the API cache on Mac OS X. * krb5_kuserok() also checks ~/.k5login.d directory for acl files, see manpage for krb5_kuserok for description. * Many, many, other updates to code and info manual and manual pages. * Bug fixes Changes in release 0.7.2 * Fix security problem in rshd that enable an attacker to overwrite and change ownership of any file that root could write. * Fix a DOS in telnetd. The attacker could force the server to crash in a NULL de-reference before the user logged in, resulting in inetd turning telnetd off because it forked too fast. * Make gss_acquire_cred(GSS_C_ACCEPT) check that the requested name exists in the keytab before returning success. This allows servers to check if its even possible to use GSSAPI. * Fix receiving end of token delegation for GSS-API. It still wrongly uses subkey for sending for compatibility reasons, this will change in 0.8. * telnetd, login and rshd are now more verbose in logging failed and successful logins. * Bug fixes Changes in release 0.7.1 * Bug fixes Changes in release 0.7 * Support for KCM, a process based credential cache * Support CCAPI credential cache * SPNEGO support * AES (and the gssapi conterpart, CFX) support * Adding new and improve old documentation * Bug fixes Changes in release 0.6.6 * Fix security problem in rshd that enable an attacker to overwrite and change ownership of any file that root could write. * Fix a DOS in telnetd. The attacker could force the server to crash in a NULL de-reference before the user logged in, resulting in inetd turning telnetd off because it forked too fast. Changes in release 0.6.5 * fix vulnerabilities in telnetd * unbreak Kerberos 4 and kaserver Changes in release 0.6.4 * fix vulnerabilities in telnet * rshd: encryption without a separate error socket should now work * telnet now uses appdefaults for the encrypt and forward/forwardable settings * bug fixes Changes in release 0.6.3 * fix vulnerabilities in ftpd * support for linux AFS /proc "syscalls" * support for RFC3244 (Windows 2000 Kerberos Change/Set Password) in kpasswdd * fix possible KDC denial of service * bug fixes Changes in release 0.6.2 * Fix possible buffer overrun in v4 kadmin (which now defaults to off) Changes in release 0.6.1 * Fixed ARCFOUR suppport * Cross realm vulnerability * kdc: fix denial of service attack * kdc: stop clients from renewing tickets into the future * bug fixes Changes in release 0.6 * The DES3 GSS-API mechanism has been changed to inter-operate with other GSSAPI implementations. See man page for gssapi(3) how to turn on generation of correct MIC messages. Next major release of heimdal will generate correct MIC by default. * More complete GSS-API support * Better AFS support: kdc (524) supports 2b; 524 in kdc and AFS support in applications no longer requires Kerberos 4 libs * Kerberos 4 support in kdc defaults to turned off (includes ka and 524) * other bug fixes Changes in release 0.5.2 * kdc: add option for disabling v4 cross-realm (defaults to off) * bug fixes Changes in release 0.5.1 * kadmind: fix remote exploit * kadmind: add option to disable kerberos 4 * kdc: make sure kaserver token life is positive * telnet: use the session key if there is no subkey * fix EPSV parsing in ftp * other bug fixes Changes in release 0.5 * add --detach option to kdc * allow setting forward and forwardable option in telnet from .telnetrc, with override from command line * accept addresses with or without ports in krb5_rd_cred * make it work with modern openssl * use our own string2key function even with openssl (that handles weak keys incorrectly) * more system-specific requirements in login * do not use getlogin() to determine root in su * telnet: abort if telnetd does not support encryption * update autoconf to 2.53 * update config.guess, config.sub * other bug fixes Changes in release 0.4e * improve libcrypto and database autoconf tests * do not care about salting of server principals when serving v4 requests * some improvements to gssapi library * test for existing compile_et/libcom_err * portability fixes * bug fixes Changes in release 0.4d * fix some problems when using libcrypto from openssl * handle /dev/ptmx `unix98' ptys on Linux * add some forgotten man pages * rsh: clean-up and add man page * fix -A and -a in builtin-ls in tpd * fix building problem on Irix * make `ktutil get' more efficient * bug fixes Changes in release 0.4c * fix buffer overrun in telnetd * repair some of the v4 fallback code in kinit * add more shared library dependencies * simplify and fix hprop handling of v4 databases * fix some building problems (osf's sia and osfc2 login) * bug fixes Changes in release 0.4b * update the shared library version numbers correctly Changes in release 0.4a * corrected key used for checksum in mk_safe, unfortunately this makes it backwards incompatible * update to autoconf 2.50, libtool 1.4 * re-write dns/config lookups (krb5_krbhst API) * make order of using subkeys consistent * add man page links * add more man pages * remove rfc2052 support, now only rfc2782 is supported * always build with kaserver protocol support in the KDC (assuming KRB4 is enabled) and support for reading kaserver databases in hprop Changes in release 0.3f * change default keytab to ANY:FILE:/etc/krb5.keytab,krb4:/etc/srvtab, the new keytab type that tries both of these in order (SRVTAB is also an alias for krb4:) * improve error reporting and error handling (error messages should be more detailed and more useful) * improve building with openssl * add kadmin -K, rcp -F * fix two incorrect weak DES keys * fix building of kaserver compat in KDC * the API is closer to what MIT krb5 is using * more compatible with windows 2000 * removed some memory leaks * bug fixes Changes in release 0.3e * rcp program included * fix buffer overrun in ftpd * handle omitted sequence numbers as zeroes to handle MIT krb5 that cannot generate zero sequence numbers * handle v4 /.k files better * configure/portability fixes * fixes in parsing of options to kadmin (sub-)commands * handle errors in kadmin load better * bug fixes Changes in release 0.3d * add krb5-config * fix a bug in 3des gss-api mechanism, making it compatible with the specification and the MIT implementation * make telnetd only allow a specific list of environment variables to stop it from setting `sensitive' variables * try to use an existing libdes * lib/krb5, kdc: use correct usage type for ap-req messages. This should improve compatability with MIT krb5 when using 3DES encryption types * kdc: fix memory allocation problem * update config.guess and config.sub * lib/roken: more stuff implemented * bug fixes and portability enhancements Changes in release 0.3c * lib/krb5: memory caches now support the resolve operation * appl/login: set PATH to some sane default * kadmind: handle several realms * bug fixes (including memory leaks) Changes in release 0.3b * kdc: prefer default-salted keys on v5 requests * kdc: lowercase hostnames in v4 mode * hprop: handle more types of MIT salts * lib/krb5: fix memory leak * bug fixes Changes in release 0.3a: * implement arcfour-hmac-md5 to interoperate with W2K * modularise the handling of the master key, and allow for other encryption types. This makes it easier to import a database from some other source without having to re-encrypt all keys. * allow for better control over which encryption types are created * make kinit fallback to v4 if given a v4 KDC * make klist work better with v4 and v5, and add some more MIT compatibility options * make the kdc listen on the krb524 (4444) port for compatibility with MIT krb5 clients * implement more DCE/DFS support, enabled with --enable-dce, see lib/kdfs and appl/dceutils * make the sequence numbers work correctly * bug fixes Changes in release 0.2t: * bug fixes Changes in release 0.2s: * add OpenLDAP support in hdb * login will get v4 tickets when it receives forwarded tickets * xnlock supports both v5 and v4 * repair source routing for telnet * fix building problems with krb4 (krb_mk_req) * bug fixes Changes in release 0.2r: * fix realloc memory corruption bug in kdc * `add --key' and `cpw --key' in kadmin * klist supports listing v4 tickets * update config.guess and config.sub * make v4 -> v5 principal name conversion more robust * support for anonymous tickets * new man-pages * telnetd: do not negotiate KERBEROS5 authentication if there's no keytab. * use and set expiration and not password expiration when dumping to/from ka server databases / krb4 databases * make the code happier with 64-bit time_t * follow RFC2782 and by default do not look for non-underscore SRV names Changes in release 0.2q: * bug fix in tcp-handling in kdc * bug fix in expand_hostname Changes in release 0.2p: * bug fix in `kadmin load/merge' * bug fix in krb5_parse_address Changes in release 0.2o: * gss_{import,export}_sec_context added to libgssapi * new option --addresses to kdc (for listening on an explicit set of addresses) * bug fixes in the krb4 and kaserver emulation part of the kdc * other bug fixes Changes in release 0.2n: * more robust parsing of dump files in kadmin * changed default timestamp format for log messages to extended ISO 8601 format (Y-M-DTH:M:S) * changed md4/md5/sha1 APIes to be de-facto `standard' * always make hostname into lower-case before creating principal * small bits of more MIT-compatability * bug fixes Changes in release 0.2m: * handle glibc's getaddrinfo() that returns several ai_canonname * new endian test * man pages fixes Changes in release 0.2l: * bug fixes Changes in release 0.2k: * better IPv6 test * make struct sockaddr_storage in roken work better on alphas * some missing [hn]to[hn]s fixed. * allow users to change their own passwords with kadmin (with initial tickets) * fix stupid bug in parsing KDC specification * add `ktutil change' and `ktutil purge' Changes in release 0.2j: * builds on Irix * ftpd works in passive mode * should build on cygwin * work around broken IPv6-code on OpenBSD 2.6, also add configure option --disable-ipv6 Changes in release 0.2i: * use getaddrinfo in the missing places. * fix SRV lookup for admin server * use get{addr,name}info everywhere. and implement it in terms of getipnodeby{name,addr} (which uses gethostbyname{,2} and gethostbyaddr) Changes in release 0.2h: * fix typo in kx (now compiles) Changes in release 0.2g: * lots of bug fixes: * push works * repair appl/test programs * sockaddr_storage works on solaris (alignment issues) * works better with non-roken getaddrinfo * rsh works * some non standard C constructs removed Changes in release 0.2f: * support SRV records for kpasswd * look for both _kerberos and krb5-realm when doing host -> realm mapping Changes in release 0.2e: * changed copyright notices to remove `advertising'-clause. * get{addr,name}info added to roken and used in the other code (this makes things work much better with hosts with both v4 and v6 addresses, among other things) * do pre-auth for both password and key-based get_in_tkt * support for having several databases * new command `del_enctype' in kadmin * strptime (and new strftime) add to roken * more paranoia about finding libdb * bug fixes Changes in release 0.2d: * new configuration option [libdefaults]default_etypes_des * internal ls in ftpd builds without KRB4 * kx/rsh/push/pop_debug tries v5 and v4 consistenly * build bug fixes * other bug fixes Changes in release 0.2c: * bug fixes (see ChangeLog's for details) Changes in release 0.2b: * bug fixes * actually bump shared library versions Changes in release 0.2a: * a new program verify_krb5_conf for checking your /etc/krb5.conf * add 3DES keys when changing password * support null keys in database * support multiple local realms * implement a keytab backend for AFS KeyFile's * implement a keytab backend for v4 srvtabs * implement `ktutil copy' * support password quality control in v4 kadmind * improvements in v4 compat kadmind * handle the case of having the correct cred in the ccache but with the wrong encryption type better * v6-ify the remaining programs. * internal ls in ftpd * rename strcpy_truncate/strcat_truncate to strlcpy/strlcat * add `ank --random-password' and `cpw --random-password' in kadmin * some programs and documentation for trying to talk to a W2K KDC * bug fixes Changes in release 0.1m: * support for getting default from krb5.conf for kinit/kf/rsh/telnet. From Miroslav Ruda <ruda@ics.muni.cz> * v6-ify hprop and hpropd * support numeric addresses in krb5_mk_req * shadow support in login and su. From Miroslav Ruda <ruda@ics.muni.cz> * make rsh/rshd IPv6-aware * make the gssapi sample applications better at reporting errors * lots of bug fixes * handle systems with v6-aware libc and non-v6 kernels (like Linux with glibc 2.1) better * hide failure of ERPT in ftp * lots of bug fixes Changes in release 0.1l: * make ftp and ftpd IPv6-aware * add inet_pton to roken * more IPv6-awareness * make mini_inetd v6 aware Changes in release 0.1k: * bump shared libraries versions * add roken version of inet_ntop * merge more changes to rshd Changes in release 0.1j: * restore back to the `old' 3DES code. This was supposed to be done in 0.1h and 0.1i but I did a CVS screw-up. * make telnetd handle v6 connections Changes in release 0.1i: * start using `struct sockaddr_storage' which simplifies the code (with a fallback definition if it's not defined) * bug fixes (including in hprop and kf) * don't use mawk which seems to mishandle roken.awk * get_addrs should be able to handle v6 addresses on Linux (with the required patch to the Linux kernel -- ask within) * rshd builds with shadow passwords Changes in release 0.1h: * kf: new program for forwarding credentials * portability fixes * make forwarding credentials work with MIT code * better conversion of ka database * add etc/services.append * correct `modified by' from kpasswdd * lots of bug fixes Changes in release 0.1g: * kgetcred: new program for explicitly obtaining tickets * configure fixes * krb5-aware kx * bug fixes Changes in release 0.1f; * experimental support for v4 kadmin protokoll in kadmind * bug fixes Changes in release 0.1e: * try to handle old DCE and MIT kdcs * support for older versions of credential cache files and keytabs * postdated tickets work * support for password quality checks in kpasswdd * new flag --enable-kaserver for kdc * renew fixes * prototype su program * updated (some) manpages * support for KDC resource records * should build with --without-krb4 * bug fixes Changes in release 0.1d: * Support building with DB2 (uses 1.85-compat API) * Support krb5-realm.DOMAIN in DNS * new `ktutil srvcreate' * v4/kafs support in klist/kdestroy * bug fixes Changes in release 0.1c: * fix ASN.1 encoding of signed integers * somewhat working `ktutil get' * some documentation updates * update to Autoconf 2.13 and Automake 1.4 * the usual bug fixes Changes in release 0.1b: * some old -> new crypto conversion utils * bug fixes Changes in release 0.1a: * new crypto code * more bug fixes * make sure we ask for DES keys in gssapi * support signed ints in ASN1 * IPv6-bug fixes Changes in release 0.0u: * lots of bug fixes Changes in release 0.0t: * more robust parsing of krb5.conf * include net{read,write} in lib/roken * bug fixes Changes in release 0.0s: * kludges for parsing options to rsh * more robust parsing of krb5.conf * removed some arbitrary limits * bug fixes Changes in release 0.0r: * default options for some programs * bug fixes Changes in release 0.0q: * support for building shared libraries with libtool * bug fixes Changes in release 0.0p: * keytab moved to /etc/krb5.keytab * avoid false detection of IPv6 on Linux * Lots of more functionality in the gssapi-library * hprop can now read ka-server databases * bug fixes Changes in release 0.0o: * FTP with GSSAPI support. * Bug fixes. Changes in release 0.0n: * Incremental database propagation. * Somewhat improved kadmin ui; the stuff in admin is now removed. * Some support for using enctypes instead of keytypes. * Lots of other improvement and bug fixes, see ChangeLog for details. |