Skip to content

Commit a159ad3

Browse files
author
Neil Conway
committed
Remove support for Kerberos V4. It seems no one is using this, it has
some security issues, and upstream has declared it "dead". Patch from Magnus Hagander, minor editorialization from Neil Conway.
1 parent a051da0 commit a159ad3

File tree

19 files changed

+46
-794
lines changed

19 files changed

+46
-794
lines changed

‎configure

Lines changed: 1 addition & 386 deletions
Large diffs are not rendered by default.

‎configure.in

Lines changed: 1 addition & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
dnl Process this file with autoconf to produce a configure script.
2-
dnl $PostgreSQL: pgsql/configure.in,v 1.412 2005/06/04 20:42:41 momjian Exp $
2+
dnl $PostgreSQL: pgsql/configure.in,v 1.413 2005/06/27 02:04:23 neilc Exp $
33
dnl
44
dnl Developers, please strive to achieve this order:
55
dnl
@@ -409,19 +409,6 @@ PGAC_ARG_BOOL(with, python, no, [ --with-python build Python modules
409409
AC_MSG_RESULT([$with_python])
410410
AC_SUBST(with_python)
411411

412-
#
413-
# Kerberos 4
414-
#
415-
AC_MSG_CHECKING([whether to build with Kerberos 4 support])
416-
PGAC_ARG_BOOL(with, krb4, no, [ --with-krb4 build with Kerberos 4 support],
417-
[
418-
AC_DEFINE(KRB4, 1, [Define to build with Kerberos 4 support. (--with-krb4)])
419-
krb_srvtab="/etc/srvtab"
420-
])
421-
AC_MSG_RESULT([$with_krb4])
422-
AC_SUBST(with_krb4)
423-
424-
425412
#
426413
# Kerberos 5
427414
#
@@ -435,11 +422,6 @@ AC_MSG_RESULT([$with_krb5])
435422
AC_SUBST(with_krb5)
436423

437424

438-
# Using both Kerberos 4 and Kerberos 5 at the same time isn't going to work.
439-
if test "$with_krb4" = yes && test "$with_krb5" = yes ; then
440-
AC_MSG_ERROR([Kerberos 4 and Kerberos 5 support cannot be combined])
441-
fi
442-
443425
AC_SUBST(krb_srvtab)
444426

445427

@@ -666,12 +648,6 @@ else
666648
*** Not using spinlocks will cause poor performance.])
667649
fi
668650

669-
if test "$with_krb4" = yes ; then
670-
AC_CHECK_LIB(des, des_encrypt, [], [AC_MSG_ERROR([library 'des' is required for Kerberos 4])])
671-
AC_CHECK_LIB(krb, krb_sendauth, [], [AC_MSG_ERROR([library 'krb' is required for Kerberos 4])])
672-
AC_REPLACE_FUNCS([gethostname])
673-
fi
674-
675651
if test "$with_krb5" = yes ; then
676652
if test "$PORTNAME" != "win32"; then
677653
AC_SEARCH_LIBS(com_err, [krb5 'krb5 -ldes -lasn1 -lroken' com_err], [],
@@ -762,10 +738,6 @@ failure. It is possible the compiler isn't looking in the proper directory.
762738
Use --without-zlib to disable zlib support.])])
763739
fi
764740

765-
if test "$with_krb4" = yes ; then
766-
AC_CHECK_HEADER(krb.h, [], [AC_MSG_ERROR([header file <krb.h> is required for Kerberos 4])])
767-
fi
768-
769741
if test "$with_krb5" = yes ; then
770742
AC_CHECK_HEADER(krb5.h, [], [AC_MSG_ERROR([header file <krb5.h> is required for Kerberos 5])])
771743
fi

‎doc/src/sgml/client-auth.sgml

Lines changed: 5 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<!--
2-
$PostgreSQL: pgsql/doc/src/sgml/client-auth.sgml,v 1.81 2005/06/21 04:02:29 tgl Exp $
2+
$PostgreSQL: pgsql/doc/src/sgml/client-auth.sgml,v 1.82 2005/06/27 02:04:23 neilc Exp $
33
-->
44

55
<chapter id="client-authentication">
@@ -326,17 +326,6 @@ hostnossl <replaceable>database</replaceable> <replaceable>user</replaceable>
326326
</listitem>
327327
</varlistentry>
328328

329-
<varlistentry>
330-
<term><literal>krb4</></term>
331-
<listitem>
332-
<para>
333-
Use Kerberos V4 to authenticate the user. This is only
334-
available for TCP/IP connections. See <xref
335-
linkend="kerberos-auth"> for details.
336-
</para>
337-
</listitem>
338-
</varlistentry>
339-
340329
<varlistentry>
341330
<term><literal>krb5</></term>
342331
<listitem>
@@ -623,11 +612,8 @@ local db1,db2,@demodbs all md5
623612
</para>
624613

625614
<para>
626-
While <productname>PostgreSQL</> supports both Kerberos 4 and
627-
Kerberos 5, only Kerberos 5 is recommended. Kerberos 4 is
628-
considered insecure and no longer recommended for general
629-
use. Only one version of Kerberos can be supported in any one
630-
build, and support must be enabled at build time. See
615+
<productname>PostgreSQL</> supports Kerberos version 5, and it has
616+
to be enabled at build time. See
631617
<xref linkend="installation"> for more information.
632618
</para>
633619

@@ -669,11 +655,9 @@ local db1,db2,@demodbs all md5
669655
account. (See also <xref linkend="postgres-user">.) The location
670656
of the key file is specified by the <xref
671657
linkend="guc-krb-server-keyfile"> configuration
672-
parameter. The default
673-
is <filename>/etc/srvtab</> if you are using Kerberos 4 and
658+
parameter. The default is
674659
<filename>/usr/local/pgsql/etc/krb5.keytab</> (or whichever
675-
directory was specified as <varname>sysconfdir</> at build time)
676-
with Kerberos 5.
660+
directory was specified as <varname>sysconfdir</> at build time).
677661
</para>
678662

679663
<para>

‎doc/src/sgml/installation.sgml

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<!-- $PostgreSQL: pgsql/doc/src/sgml/installation.sgml,v 1.237 2005/06/21 20:45:43 tgl Exp $ -->
1+
<!-- $PostgreSQL: pgsql/doc/src/sgml/installation.sgml,v 1.238 2005/06/27 02:04:23 neilc Exp $ -->
22

33
<chapter id="installation">
44
<title><![%standalone-include[<productname>PostgreSQL</>]]>
@@ -787,12 +787,10 @@ su - postgres
787787
</varlistentry>
788788

789789
<varlistentry>
790-
<term><option>--with-krb4</option></term>
791790
<term><option>--with-krb5</option></term>
792791
<listitem>
793792
<para>
794-
Build with support for Kerberos authentication. You can use
795-
either Kerberos version 4 or 5, but not both. On many
793+
Build with support for Kerberos 5 authentication. On many
796794
systems, the Kerberos system is not installed in a location
797795
that is searched by default (e.g., <filename>/usr/include</>,
798796
<filename>/usr/lib</>), so you must use the options

‎doc/src/sgml/libpq.sgml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<!--
2-
$PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.187 2005/06/26 19:16:04 tgl Exp $
2+
$PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.188 2005/06/27 02:04:24 neilc Exp $
33
-->
44

55
<chapter id="libpq">
@@ -283,7 +283,7 @@ PGconn *PQconnectdb(const char *conninfo);
283283
<term><literal>krbsrvname</literal></term>
284284
<listitem>
285285
<para>
286-
Kerberos service name to use when authenticating with Kerberos 4 or 5.
286+
Kerberos service name to use when authenticating with Kerberos 5.
287287
This must match the service name specified in the server
288288
configuration for Kerberos authentication to succeed. (See also
289289
<xref linkend="kerberos-auth">.)
@@ -3813,7 +3813,7 @@ setting, and is only available if
38133813
<primary><envar>PGKRBSRVNAME</envar></primary>
38143814
</indexterm>
38153815
<envar>PGKRBSRVNAME</envar> sets the Kerberos service name to use when
3816-
authenticating with Kerberos 4 or 5.
3816+
authenticating with Kerberos 5.
38173817
</para>
38183818
</listitem>
38193819
<listitem>

‎doc/src/sgml/protocol.sgml

Lines changed: 1 addition & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<!-- $PostgreSQL: pgsql/doc/src/sgml/protocol.sgml,v 1.60 2005/06/26 19:16:04 tgl Exp $ -->
1+
<!-- $PostgreSQL: pgsql/doc/src/sgml/protocol.sgml,v 1.61 2005/06/27 02:04:24 neilc Exp $ -->
22

33
<chapter id="protocol">
44
<title>Frontend/Backend Protocol</title>
@@ -264,19 +264,6 @@
264264
</listitem>
265265
</varlistentry>
266266

267-
<varlistentry>
268-
<term>AuthenticationKerberosV4</term>
269-
<listitem>
270-
<para>
271-
The frontend must now take part in a Kerberos V4
272-
authentication dialog (not described here, part of the
273-
Kerberos specification) with the server. If this is
274-
successful, the server responds with an AuthenticationOk,
275-
otherwise it responds with an ErrorResponse.
276-
</para>
277-
</listitem>
278-
</varlistentry>
279-
280267
<varlistentry>
281268
<term>AuthenticationKerberosV5</term>
282269
<listitem>
@@ -1411,50 +1398,6 @@ AuthenticationOk (B)
14111398
</varlistentry>
14121399

14131400

1414-
<varlistentry>
1415-
<term>
1416-
AuthenticationKerberosV4 (B)
1417-
</term>
1418-
<listitem>
1419-
<para>
1420-
1421-
<variablelist>
1422-
<varlistentry>
1423-
<term>
1424-
Byte1('R')
1425-
</term>
1426-
<listitem>
1427-
<para>
1428-
Identifies the message as an authentication request.
1429-
</para>
1430-
</listitem>
1431-
</varlistentry>
1432-
<varlistentry>
1433-
<term>
1434-
Int32(8)
1435-
</term>
1436-
<listitem>
1437-
<para>
1438-
Length of message contents in bytes, including self.
1439-
</para>
1440-
</listitem>
1441-
</varlistentry>
1442-
<varlistentry>
1443-
<term>
1444-
Int32(1)
1445-
</term>
1446-
<listitem>
1447-
<para>
1448-
Specifies that Kerberos V4 authentication is required.
1449-
</para>
1450-
</listitem>
1451-
</varlistentry>
1452-
</variablelist>
1453-
</para>
1454-
</listitem>
1455-
</varlistentry>
1456-
1457-
14581401
<varlistentry>
14591402
<term>
14601403
AuthenticationKerberosV5 (B)

‎src/backend/libpq/auth.c

Lines changed: 4 additions & 96 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $PostgreSQL: pgsql/src/backend/libpq/auth.c,v 1.125 2005/06/14 17:43:13 momjian Exp $
11+
* $PostgreSQL: pgsql/src/backend/libpq/auth.c,v 1.126 2005/06/27 02:04:24 neilc Exp $
1212
*
1313
*-------------------------------------------------------------------------
1414
*/
@@ -69,83 +69,6 @@ static Port *pam_port_cludge; /* Workaround for passing "Port *port"
6969
* into pam_passwd_conv_proc */
7070
#endif /* USE_PAM */
7171

72-
#ifdef KRB4
73-
/*----------------------------------------------------------------
74-
* MIT Kerberos authentication system - protocol version 4
75-
*----------------------------------------------------------------
76-
*/
77-
78-
#include "krb.h"
79-
80-
/*
81-
* pg_krb4_recvauth -- server routine to receive authentication information
82-
* from the client
83-
*
84-
* Nothing unusual here, except that we compare the username obtained from
85-
* the client's setup packet to the authenticated name. (We have to retain
86-
* the name in the setup packet since we have to retain the ability to handle
87-
* unauthenticated connections.)
88-
*/
89-
static int
90-
pg_krb4_recvauth(Port *port)
91-
{
92-
long krbopts = 0; /* one-way authentication */
93-
KTEXT_ST clttkt;
94-
char instance[INST_SZ + 1],
95-
version[KRB_SENDAUTH_VLEN + 1];
96-
AUTH_DAT auth_data;
97-
Key_schedule key_sched;
98-
int status;
99-
100-
strcpy(instance, "*"); /* don't care, but arg gets expanded
101-
* anyway */
102-
status = krb_recvauth(krbopts,
103-
port->sock,
104-
&clttkt,
105-
pg_krb_srvnam,
106-
instance,
107-
&port->raddr.in,
108-
&port->laddr.in,
109-
&auth_data,
110-
pg_krb_server_keyfile,
111-
key_sched,
112-
version);
113-
if (status != KSUCCESS)
114-
{
115-
ereport(LOG,
116-
(errmsg("Kerberos error: %s", krb_err_txt[status])));
117-
return STATUS_ERROR;
118-
}
119-
if (strncmp(version, PG_KRB4_VERSION, KRB_SENDAUTH_VLEN) != 0)
120-
{
121-
ereport(LOG,
122-
(errmsg("unexpected Kerberos protocol version received from client (received \"%s\", expected \"%s\")",
123-
version, PG_KRB4_VERSION)));
124-
return STATUS_ERROR;
125-
}
126-
if (strncmp(port->user_name, auth_data.pname, SM_DATABASE_USER) != 0)
127-
{
128-
ereport(LOG,
129-
(errmsg("unexpected Kerberos user name received from client (received \"%s\", expected \"%s\")",
130-
port->user_name, auth_data.pname)));
131-
return STATUS_ERROR;
132-
}
133-
return STATUS_OK;
134-
}
135-
136-
#else
137-
138-
static int
139-
pg_krb4_recvauth(Port *port)
140-
{
141-
ereport(LOG,
142-
(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
143-
errmsg("Kerberos 4 not implemented on this server")));
144-
return STATUS_ERROR;
145-
}
146-
#endif /* KRB4 */
147-
148-
14972
#ifdef KRB5
15073
/*----------------------------------------------------------------
15174
* MIT Kerberos authentication system - protocol version 5
@@ -252,8 +175,7 @@ pg_krb5_init(void)
252175
* from the client
253176
*
254177
* We still need to compare the username obtained from the client's setup
255-
* packet to the authenticated name, as described in pg_krb4_recvauth. This
256-
* is a bit more problematic in v5, as described above in pg_an_to_ln.
178+
* packet to the authenticated name.
257179
*
258180
* We have our own keytab file because postgres is unlikely to run as root,
259181
* and so cannot read the default keytab.
@@ -380,9 +302,6 @@ auth_failed(Port *port, int status)
380302
case uaReject:
381303
errstr = gettext_noop("authentication failed for user \"%s\": host rejected");
382304
break;
383-
case uaKrb4:
384-
errstr = gettext_noop("Kerberos 4 authentication failed for user \"%s\"");
385-
break;
386305
case uaKrb5:
387306
errstr = gettext_noop("Kerberos 5 authentication failed for user \"%s\"");
388307
break;
@@ -461,27 +380,16 @@ ClientAuthentication(Port *port)
461380
(errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION),
462381
errmsg("no pg_hba.conf entry for host \"%s\", user \"%s\", database \"%s\", %s",
463382
hostinfo, port->user_name, port->database_name,
464-
port->ssl ? _("SSL on") : _("SSL off"))));
383+
port->ssl ? _("SSL on") : _("SSL off"))));
465384
#else
466385
ereport(FATAL,
467386
(errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION),
468387
errmsg("no pg_hba.conf entry for host \"%s\", user \"%s\", database \"%s\"",
469-
hostinfo, port->user_name, port->database_name)));
388+
hostinfo, port->user_name, port->database_name)));
470389
#endif
471390
break;
472391
}
473392

474-
case uaKrb4:
475-
/* Kerberos 4 only seems to work with AF_INET. */
476-
if (port->raddr.addr.ss_family != AF_INET
477-
|| port->laddr.addr.ss_family != AF_INET)
478-
ereport(FATAL,
479-
(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
480-
errmsg("Kerberos 4 only supports IPv4 connections")));
481-
sendAuthRequest(port, AUTH_REQ_KRB4);
482-
status = pg_krb4_recvauth(port);
483-
break;
484-
485393
case uaKrb5:
486394
sendAuthRequest(port, AUTH_REQ_KRB5);
487395
status = pg_krb5_recvauth(port);

0 commit comments

Comments
 (0)