Ubuntu
krb5 package

Option no-addresses spelled wrong in "man krb.conf" (/usr/share/man/man5/krb5.conf.5.gz)

Bug #72599 reported by Sascha Silbe
4
Affects Status Importance Assigned to Milestone
krb5 (Ubuntu)
Fix Released
Undecided
Unassigned

Bug Description

Binary package hint: krb5-doc

"man krb.conf" documents an option "noaddresses" that causes Kerberos tickets to be addressless, which is needed to use Kerberos behind an NAT gateway. This option doesn't work, but using "no-addresses" (note the hyphen in the name) works fine:

Case 1: noaddresses
/etc/krb5.conf:
[libdefaults]
        noaddresses = true
[...]

sascha.silbe@caravan:~$ kinit silbe ; afslog
<email address hidden>'s Password:
afslog: krb5_afslog(<default cell>): Incorrect net address
sascha.silbe@caravan:~$

Case 2: no-addresses
/etc/krb5.conf:
[libdefaults]
        no-addresses = true
[...]

sascha.silbe@caravan:~$ kinit silbe ; afslog
<email address hidden>'s Password:
sascha.silbe@caravan:~$

Revision history for this message
Sascha Silbe (sascha-ubuntu-launchpad) wrote :

The man-page states a wrong default value, BTW. As demonstrated above, it's "false" and needs to be explicitly changed to "true".

From "man 5 krb.conf":

       noaddresses
              Setting this flag causes the initial Kerberos ticket to be addressless. The default for the flag is true.

Chris Rose (chris-vault5)
Changed in krb5:
status: Unconfirmed → Confirmed
Revision history for this message
Russ Allbery (rra-debian) wrote :

I'm not sure when it changed, but the current code matches the documentation. noaddresses is the correct option, and the default is true.

Revision history for this message
Sascha Silbe (sascha-ubuntu-launchpad) wrote :

OK, then let's close this bug for now. The machine I could test it on needs repair, which won't happen in the near future.
Thanks!

Changed in krb5:
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.