Subject: Re: [kitten] PKCROSS and philosophical tangents...

From: "Nordgren, Bryce L -FS" <[email-masked]>
Date: Sun, 16 Feb 2014 21:18:07 +0000

> Password changes are interoperable provided that they're limited to
> operations that can be performed via the kpasswd protocol (and provided
> you can deal with the kpasswd protocol, which is rather broken, but usually
> workable in practice provided everyone understands the required
> assumptions).

Please excuse the noob question. Was looking for this and found:
* draft-ietf-cat-kerb-chg-password-02 (appears dead as of 1998)
* RFC3244 (Informational/Microsoft implementation)
* draft-ietf-krb-wg-kerberos-set-passwd-08 (appears dead as of 2008 but is referenced in 2013-era RFC6880)

I didn't find an actual standards track RFC kpasswd document...Could you point me at the kpasswd protocol definition?

Thx,
Bryce

This electronic message contains information generated by the USDA solely for the intended recipients. Any unauthorized interception of this message or the use or disclosure of the information it contains may violate the law and subject the violator to civil or criminal penalties. If you believe you have received this message in error, please notify the sender and delete the email immediately.

---

From: Russ Allbery <[email-masked]>
Date: Sun, 16 Feb 2014 13:22:27 -0800

"Nordgren, Bryce L -FS" <[email-masked]> writes:

>> you can deal with the kpasswd protocol, which is rather broken, but
>> usually workable in practice provided everyone understands the required
>> assumptions).

> I didn't find an actual standards track RFC kpasswd document...Could you
> point me at the kpasswd protocol definition?

RFC 3244 is the one that everyone uses, I think.  I'm not positive if
krb5_change_password is an alternative API to the same protocol or if it
tries an older protocol as well.

-- 
Russ Allbery ([email-masked])              <http://www.eyrie.org/~eagle/>