Date: Thu, 15 Sep 2016 16:28:55 +0300 From: Slawa Olhovchenkov <slw@zxy.spb.ru> To: Garrett Wollman <wollman@bimajority.org> Cc: Benjamin Kaduk <kaduk@MIT.EDU>, freebsd-security@freebsd.org, freebsd-current@freebsd.org Subject: Re: Heimdal in base Message-ID: <20160915132855.GA2960@zxy.spb.ru> In-Reply-To: <22490.595.67496.130780@hergotha.csail.mit.edu> References: <56436F4B.8050002@FreeBSD.org> <86r3jwfpiq.fsf@desk.des.no> <20151111181339.GE48728@zxy.spb.ru> <86io58flhk.fsf@desk.des.no> <20151111184448.GR31314@zxy.spb.ru> <CAGnMC6rMaY2a_F4qpxX4rB6n6n-tvijH74jxf8j94-2V8r_V8g@mail.gmail.com> <alpine.GSO.1.10.1511122120050.26829@multics.mit.edu> <86egfu9z0j.fsf@desk.des.no> <alpine.GSO.1.10.1609141511530.5272@multics.mit.edu> <22490.595.67496.130780@hergotha.csail.mit.edu>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Sep 14, 2016 at 10:07:15PM -0400, Garrett Wollman wrote: > <<On Wed, 14 Sep 2016 15:21:46 -0400 (EDT), Benjamin Kaduk <kaduk@MIT.EDU> said: > > > Well, it's definitely too late for 11, now. > > > But, Debian is preparing to remove their heimdal package entirely, > > imminently: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=837728 > > The primary issue, so far as I can see, is that Heimdal and MIT were > only compatible in the parts of the API that were formally > standardized. For those of us who need MIT (to have a working kadmin, > for example), that has pretty much always boiled down to completely > disabling Heimdal in base (and anything that depends on it, like > OpenSSH, pam_krb5, and GSSAPI-authenticated NFS), and installing > replacement bits from ports/packages. > > If we're going to remove Heimdal from base, we should completely > deorbit (or disable, as appropriate) all of the things that depend on > it, and make sure that there are ports that provide replacement > functionality. (AFAIK the only thing missing is gssd, the user-mode > side of the authenticated NFS support.) My bet would be that very few > FreeBSD users actually take advantage of this support, and unless > they're running in an all-FreeBSD or all-Heimdal shop probably have to > install MIT Kerberos anyway. I am use gssd. For $HOME over NFS.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20160915132855.GA2960>